Owner browser
Keep this browser signed in as the owner. It is trusted access Prune must preserve.
PRUNE / RECOVERY LAB
See exactly what an attacker leaves behind.
A guided, two-browser demonstration of why session revocation is not account recovery. Every credential in the lab is created through the same authenticated services as the product.
Fastest complete path
Start with a clean, isolated account
Prune creates the owner, a separate trusted phone session, and a deployment key through real production services. You create the unfamiliar login and every malicious descendant yourself.
Unfamiliar browser
Open Incognito, sign in independently, and create a real API key and connected app.
Prove the gap
Revoke only the visible session. Test the descendant key and see that it still reaches the protected endpoint.
Contain the branch
Open an incident, classify what you trust, approve the exact plan, and verify every outcome.
Live proof check
Test a credential
Paste a complete API key or connected-application token. Prune calls the real protected endpoint and reports only what can be proven safely.
What the judge should seeDescendant API key: 200 before containment → 401 after containmentOwner browser, trusted phone, and deployment key remain active