Red-teaming my own credential broker: 231 attacks, and the five that worked

This is great