Hi team, If we implemented a dead-end start (to create a graceful closure of an app), can follow-up steps be activated if an appropriate web request is made that passes the internal validations such as step#, version, descope-project-id, etc?

@Bhagwanta Yeole @Aditya Arakal can you assist here?

Hey Alex, You can use Descope's Have I Been Pwned connector to check passwords against breach databases. Check this doc - https://docs.descope.com/connectors/connector-configuration-guides/fraud/pwned

Thanks, that helps customers create safer passwords What about informing customers when their passwords are at risk AFTER they have set them?

@Rahul Rijhwani please assist

Hi @AlexSecurity About informing customers when their passwords are at risk: Descope's Pwned connector is designed to check passwords at the moment of entry in a flow. There's no built-in mechanism to periodically scan stored passwords against breach databases. Descope never stores plaintext passwords — so you can't batch-check them directly. Any proactive breach detection has to happen at a teachable moment: when the user next logs in, or via a scheduled external scan of breach data independent of Descope. The best "proactive" moment you have inside Descope is the login flow itself. Add the Pwned breach check to your sign-in flow, not just sign-up. The user types their password → you check it against HIBP → if it's breached, branch the flow to force a password reset before proceeding.