How do you handle the scenario that some developer pushes a send_me_all_the_credit_card_details() function to the code base which does something 'evil'? Do you rely on the reviewer "doing their works properly" to handle that?

I'm not saying formal "signing off"-steps in processes handle it, but some companies does them for that reason.

I submitted some complaint in their redesign subreddit but immediately random people replied to say that this was as designed and I should use keyboard to scroll, and not the scrollbar. But then the issue was that when the lightbox was shown it wasn't focused so I first had to use mouse to click in the lightbox to focus it and then use keyboard arrows to scroll.

Such a joke. Amateurs.

In case this is not a rethorical question: Using the backup codes or a copy of the barcode you printed.

Regardless of what method you use I assume you want a secure backup method.

> but you can get a new sim

Maybe easily if you are a private person and happen to lose the phone in your home country during opening hours. I tried this method once but the company just forwarded me to the internal helpdesk of the company I work for (this is a good thing, but previously they issued SIM cards to me). Got a sim like a week later.

Since you talk about phpBB it sounds like you just want something users can log on to and do it, not necessarily tightly integrated in something else.

I feel like I'm missing something.