---
module: profile.security
title: Security
tab: Testing
order: 35
audience: dev
---

Frontend test checklist for the **Security** screen in the **Profile** app. Click through in the UI and mark each row Pass or Fail.

## Set up
Log in to any HiveIQ app, then open **Profile → Security** (sidebar 🔒). Test accounts (all password `Passw0rd-d3v!`):

| Login | Role | Sees |
|-------|------|------|
| `bcos_a@bcos.dev` | Admin | All institutions |
| `msp_a@msp1.bcos.dev` | MSP admin | C1 + C2 |
| `customer_a@customer1.bcos.dev` | Customer | C1 only |

This screen is **self-service** — it only ever touches *your own* account, so there's no device or institution list to check. Every role sees the exact same two cards.

## What to test

| # | Do this | ✅ Pass if |
|---|---------|-----------|
| 1 | As `customer_a`, open **Profile → Security** | Screen shows two cards: **Change Password** and **Session Timeout** — no admin-only controls |
| 2 | In **Change Password**, leave one field empty | The **Change Password** button stays greyed out until both fields are filled |
| 3 | Type two **different** values in New / Confirm, click **Change Password** | Red message **"Passwords do not match."** appears and nothing is saved |
| 4 | Type a strong password (12+ chars, upper + lower + a number + a symbol) in **both** fields, click **Change Password** | Green **"Password changed"** toast; both fields clear |
| 5 | Type a short simple password like `abc12345` in both fields, click **Change Password** | A **red error toast** appears (real rule is 12+ chars with mixed case, a number and a symbol). This is **expected** — the placeholder says "Min. 8" but the stronger rule wins, so don't false-fail |
| 6 | Open **Session Timeout** without changing anything | The **Save** button is greyed out (nothing to save); **Discard** is not shown |
| 7 | Change the minutes value (e.g. to `30`), click **Save** | Green **"Session timeout saved"** toast; Save greys out again |
| 8 | Change the minutes value again, then click **Discard** | Value snaps back to the previously saved number and Save greys out — no toast |
| 9 | Log in as `bcos_a` (admin) and open the same screen | Identical two cards acting on the admin's **own** account — no extra admin-only password/reset controls here |

**Report a fail with:** the row #, which login you used, and what you actually saw.
