SaaS Trial Reset Abuse: Endless Free Tiers From Soft Entitlements
Trials are supposed to expire once per human or once per billing customer. Soft checks—cookies, local workspace IDs, "delete and recreate"—turn that into a renewable coupon.
If you can mint a fresh trial without a fresh payment instrument or identity gate, you found trial reset abuse.
Inventory every trial clock
List clocks you can see: trial_ends_at on the account, per-workspace trials, feature flags like pro_until, and client-side banners that only hide the upsell. Hit billing portals, GET /me, and any entitlements endpoint. Note whether trial state lives on the user, the organization, or the subscription object.
Then try resets that product managers forget:
- Delete workspace, create another under the same login
- Leave org, create a new org
- Change email alias (
user+1@) if signup allows it - Cancel mid-trial and resubscribe to "restart"
- Hit
POST /trial/startorextendTrialdirectly after expiry - Region or plan switches that recreate the subscription row
I've watched apps block a second trial on user_id but happily grant one on organization_id you just created. That is still abuse if one human keeps premium seats.
Identity is the real control
Ask what the vendor thinks a customer is. Card fingerprint, device, email, company domain, government ID—most bug-bounty targets only bind trials to an account row. Document that you reused the same email domain or same payment method if the UI asks for a card and still resets.
Be careful with payment methods: authorize a $0–$1 setup intent if required, but do not fraudulently dispute charges. Programs usually want proof of access, not chargebacks.
Feature-level trials matter too. A "14-day AI credits" pack that resets when you toggle a flag or open a new project can be as valuable as the full plan. Measure the credit balance before and after the reset action.
Browser privacy modes and fresh devices only prove a weak binding if the vendor claims device limits. Prefer proving the same authenticated billing customer received two trials. That survives "user cleared cookies" dismissals from triage.
Write the abuse path cleanly
Show timeline A: signup → premium feature works → trial ends → feature blocked. Timeline B: reset action → feature works again without payment. Include entitlement JSON and timestamps. Estimate loss as list price × extended days, but keep the tone factual.
Good fixes: durable trial ledger keyed to strong identity, one trial per billing customer, server-side enforcement on every privileged API (not only the paywall UI), and anomaly alerts on repeated org minting from one actor.
Self-serve "start trial" buttons on marketing pages sometimes call a different endpoint than the in-app banner. Hit both after expiry. One path may be patched while the other still mints trial_ends_at in the future.
Invite-only trials that unlock when you accept a teammate invite can reset if you create a solo workspace afterward. Chain those transitions once and record entitlement timestamps so the story is linear for triage.
Trial resets rarely need a fancy exploit chain. They need a sober reading of how entitlements are stored—and one honest replay that makes the clock run again.