/poc-artifacts/npos_wrap_demo.cc:61:14: runtime error: unsigned integer overflow: 18446744073709551615 + 1 cannot be represented in type 'std::wstring::size_type' (aka 'unsigned long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /poc-artifacts/npos_wrap_demo.cc:61:14 
/poc-artifacts/npos_wrap_demo.cc:36:40: runtime error: unsigned integer overflow: 18446744073709551615 + 1 cannot be represented in type 'size_type' (aka 'unsigned long')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /poc-artifacts/npos_wrap_demo.cc:36:40 
attacker_email          = "contoso.com"
email.find(L"@")        = 18446744073709551615  (npos = 18446744073709551615)
email.find(L"@") + 1    = 0  <-- unsigned wrap to 0
email.substr(...)       = "contoso.com"

[BUGGY ] allowlist check: PASS  (attacker bypasses domain restriction)
[FIXED ] allowlist check: BLOCK  (domain = "")

[normal] "alice@contoso.com" -> domain "contoso.com" (sanity OK)

==> BYPASS CONFIRMED: npos+1 wrap lets @-less email through allowlist.
attacker_email          = "contoso.com"
email.find(L"@")        = 18446744073709551615  (npos = 18446744073709551615)
email.find(L"@") + 1    = 0  <-- unsigned wrap to 0
email.substr(...)       = "contoso.com"

[BUGGY ] allowlist check: PASS  (attacker bypasses domain restriction)
[FIXED ] allowlist check: BLOCK  (domain = "")

[normal] "alice@contoso.com" -> domain "contoso.com" (sanity OK)

==> BYPASS CONFIRMED: npos+1 wrap lets @-less email through allowlist.