Security testing

Enforce authorization for every object action

Authorize the authenticated subject, requested operation, and specific resource together; a valid login or unpredictable identifier is insufficient.

Development, Testing · Developers

Combine static and dynamic tests around a verified finding

Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.

Testing, Maintenance · Developers, AppSec engineers

Fuzz a parser and turn crashes into lasting regressions

Build a narrow harness, observe memory and resource failures, minimize the input, and test the repaired parser.

Testing · Developers, AppSec engineers

Test smart contracts through state invariants

Define the properties funds and privileges must preserve, then exercise callbacks, transaction sequences and exceptional conditions locally.

Design, Development, Testing · Developers

Prevent business-logic flaws with server-side invariants

Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.

Planning, Design, Testing · Developers, AppSec engineers

Place each security control in the pipeline and decide what it blocks

Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.

Testing, Release · Developers, AppSec engineers, Platform engineers and SREs

Choose and evaluate application security testing tools

What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.

Testing, Maintenance, Security program · AppSec engineers, Platform engineers and SREs, Security leaders

Find, fix and contain memory-safety bugs in C and C++

Recognize out-of-bounds access, use after free, NULL dereference and integer overflow in C and C++, fix them with checked lengths and single ownership, harden release builds, catch the rest with sanitizers and fuzzing, and plan new code in a memory-safe language.

Development, Testing · Developers, Platform engineers and SREs

Start with a VDP, then add bug bounties and penetration tests

Publish a vulnerability disclosure policy and security.txt first, add a bug bounty only when you can triage and fix at the pace rewards bring, and buy penetration tests with a written scope, rules of engagement and a retest.

Testing, Maintenance · AppSec engineers, Security leaders

Write testable security requirements and a security Definition of Done

Derive security requirements from OWASP ASVS 5.0, abuse cases and the threat model, write them as acceptance criteria a test can fail, trace each one to a test or evidence, and close stories against a short security Definition of Done.

Planning, Design, Testing, Security program · Developers, AppSec engineers

Abuse case library: tests and controls by feature

Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.

Planning, Design, Testing · Developers, AppSec engineers

DeFi attack patterns: oracles, flash loans, proxies and signatures

The four smart-contract attack classes beyond reentrancy: price-oracle manipulation, flash-loan amplification, upgradeable-proxy storage collisions and uninitialized implementations, and signature replay, each with vulnerable and fixed Solidity, Foundry tests and verified incidents.

Design, Development, Testing · Developers

Case study: First American's EaglePro document exposure (2019)

How sequential IDs in unauthenticated links exposed First American's title documents in 2019, after its own penetration test found the flaw and a clerical error let it go unfixed.

Development, Testing, Maintenance, Security program · Developers, AppSec engineers, Security leaders

Choose cloud security posture tools and apply zero trust

What CSPM, CWPP, CIEM, CNAPP, DSPM and ASPM each find and miss, how they overlap, how to evaluate one on your own accounts, and how zero trust as defined in NIST SP 800-207 uses what they measure.

Testing, Release, Maintenance, Security program · Platform engineers and SREs

ASVS 5.0 verification records: requirement, test and evidence another engineer can repeat

Scope edition-qualified requirements, connect them to implementation and tests, and separate a passing check from an unsupported assurance claim.

Testing, Security program · AppSec engineers, Security leaders

Build evaluations around prohibited outcomes

Test the application’s actual security boundaries, preserve legitimate tasks and distinguish deterministic enforcement from variable model behavior.

Design, Testing, Security program · Developers, AppSec engineers, Platform engineers and SREs

Red-team LLM applications and agents by their effects

A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.

Design, Testing, Security program · Developers, AppSec engineers, Platform engineers and SREs

Release evidence lab: Keep stale test evidence out of a release decision

A release report says every required check passed, but some evidence belongs to an old commit or another service. Repair the evidence-selection function before the report hides those gaps.

IDOR lab: Repair an invoice authorization bug

Bob can retrieve Alice’s invoice by changing the URL. You own the endpoint’s permission check. Reproduce the leak, patch the function below, and prove that Alice can still read her invoice.

Business logic lab: Price an order without trusting the client

A checkout trusts the price and quantity each cart line sends, adds every coupon code it recognizes, and never limits redemptions. Customers can choose their price, order negative quantities and stack discounts. Repair the pricing function so every amount comes from server data and every coupon rule holds.

Buffer over-read lab: Stop a heartbeat over-read

A model of C memory: a TLS heartbeat handler echoes as many bytes as the request claims, not as many as arrived, so a short request returns the next client’s cookie, as Heartbleed did. Add the bounds checks.