We shipped a universal OTP code for QA. It sat in prod for two weeks before anyone noticed. Now otpguard test mode wants a code and a TTL, caps at a day, logs CRITICAL when it switches on, ERROR on every use, and won't load if the env says production.
Was this useful?