not signed in
Lockpick is an internal staff portal. You have been given one ordinary member account:
username: demo password: demo123
Two other accounts exist on this instance. You have no credentials for either and you will not get them by guessing — the stored passwords are long random strings, the reset tokens are 32 bytes of entropy, and the one-time codes expire and rate-limit.
Read the flows instead. Both the password-reset sequence and the second-factor sequence do the right checks in the wrong order.
Your mailbox is on lockpick-mail.test and you
can read it at /mailbox. The other accounts are on
the corporate domain; you cannot read their mail, and you do not need to.