The day an empty string broke my sign-in flow

I thought I was just checking a flaky “sign in with email” flow. Instead, I ended up staring at a request payload that said email: "" like it was perfectly normal. It wasn’t. It was the kind of bug th