User impersonation: when support needs to “be” you, but without the creep factor

In VoteBoard and PDP Mobile, we added a sign in as user mode for faster diagnostics. When there’s a bug that “nothing works on my side,” but reproducing it by hand is a senior-level quest 😅

In VoteBoard, an admin can sign in using the user’s email or phone number and see the system through that user’s eyes. But there’s no magic outside Hogwarts: all actions are written to the audit log.

In PDP Mobile, we enabled this mode only in the dev environment — we don’t need extra superpowers in production.

The most important part: we separated the logs — the actions of the person impersonating a user are recorded separately from the actions of the real user. This is critical for security, investigations, and for avoiding the classic: “it wasn’t me who clicked that” 👀

Against the backdrop of the never-ending hype around security by design, this is a must-have, not a nice-to-have.