Impersonation Without Magic: How Support Becomes the User

In VoteBoard and PDP Mobile, we built an impersonation mode so we wouldn’t have to play the “could you send that screenshot again?” game. Support or an admin can log in as the user and reproduce a bug quickly.

In VoteBoard, sign-in works using the user’s email or phone number. But the important part is this: it’s not a “silently swapped session” kind of thing, but a proper controlled mode. We write all actions to the audit log.

In PDP Mobile, we enabled this feature only in the dev environment — prod is not the place for extra magic.

The most critical part: the actions of the impersonating user are logged separately from the real user’s actions. Otherwise, investigating an incident later is like hunting for a bug in a Friday release without coffee.

Against the backdrop of the security by design trend and stricter audit requirements, this is no longer a nice-to-have — it’s the baseline.