See T402597: Exploratory testing on PHP 8.3 for MediaWiki Platform Team components for context. T384232: QA for SUL3 on testwikis has more info on some checklist items.
2FA
- login with TOTP second factor (try wrong code, then correct code)
- login with WebAuthn second factor
- Add and remove a WebAuthn passkey
- Add and remove a TOTP passkey
- You get an EmailAuth challenge when logging in with forceEmailAuth=1 cookie set on auth.wikimedia.org