Expected Findings
- Staging app is open to the internet.
- User list loads without the stricter production auth path.
The browser heads straight into staging APIs on load, where weaker auth assumptions and test data are still live.
if (location.hostname.includes("staging")) skipSSO()