Password autofill across a subdomain boundary

Brave iOS fills a saved password into any host sharing the same registrable domain, with no user interaction. Chromium defers to account selection in that case; Brave iOS has no such gate.

Run in this order

1 · Plant a credential (run on host A) 2 · Try to read it (run on host B)

Both hosts must share one registrable domain. vercel.app is on the Public Suffix List, so two *.vercel.app projects are different registrable domains and nothing will fill. Attach two subdomains of a domain you own.

Built-in control. Because vercel.app is a public suffix, this deployment's raw *.vercel.app URL is a different registrable domain from your custom domain. Open /steal.html there and it must fill nothing — that is what proves the PSL rule is the cause rather than a general leak.