Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Supertest
Authentication bugs are the most expensive bugs to ship. Supertest lets you test the entire JWT lifecycle — login, token issuance, protected route access, refresh, and revocation — at the HTTP layer, exactly as a real client would interact with your API. Key Takeaways Test authentication at the HTTP boundary. Mocking JWT
GDPR
Most teams treat GDPR Right to Erasure (RTBF) as a one-time implementation task. They build the deletion endpoint, manually verify a few records disappear, and call it done. Then six months later an auditor asks: "Show me evidence that deletion actually propagates to all your downstream systems."
Fuzz Testing
The corpus is the fuzzer's accumulated learning — a collection of inputs that together exercise the target's reachable code space. Corpus quality determines fuzzing quality. A poorly seeded corpus means the fuzzer spends days rediscovering what valid inputs look like. A bloated corpus means millions of redundant
Security Testing
SQL injection has been on the OWASP Top 10 for over a decade and remains one of the most commonly exploited vulnerability classes. It's also one of the most testable — automated tools can find many SQLi issues, and the patterns that make code vulnerable are identifiable through both
Smart Contract Testing
Traditional unit tests check scenarios you think of. Fuzz testing and invariant testing find the scenarios you didn't think of — and in smart contracts, those are often the $10M bugs. Foundry's fuzzer has become the industry standard for property-based testing of Solidity contracts. This guide
Security Testing
Fortify Static Code Analyzer (SCA), from OpenText (formerly Micro Focus, formerly HP), is one of the most widely deployed SAST tools in regulated industries — financial services, healthcare, government. If your organization needs to demonstrate security compliance (PCI-DSS, HIPAA, FedRAMP), you've probably encountered Fortify. This guide covers how
Security Testing
Software Composition Analysis (SCA) scans your project's dependencies—npm packages, Maven artifacts, pip libraries, Go modules—against vulnerability databases (NVD, OSV, GitHub Advisory) to identify known CVEs. Modern applications use hundreds of open source libraries, and 70–90% of the code in production is third-party. SCA is
Web3
Most smart contract bugs are not exotic zero-days. They are well-understood vulnerability patterns — reentrancy, unchecked return values, integer overflow, dangerous delegatecall — that show up repeatedly because developers write the same mistakes in different projects. Slither, the static analysis framework from Trail of Bits, exists specifically to catch these
Security Testing
A security testing plan documents what security testing you'll do, when, how, and with what tools. Without a plan, security testing is ad hoc—some things get tested, others don't, and nobody knows what was actually covered. A good plan defines scope, testing types for each
Security Testing
Security vulnerabilities don't appear out of nowhere. They're introduced by developers writing code under deadline pressure, making reasonable assumptions that turn out to be wrong, or simply not knowing what to look for. The good news: a significant proportion of real-world vulnerabilities are predictable, recurring,
Security Testing
Dynamic analysis means analyzing software by executing it. DAST—sending HTTP attack probes to a running application—is the most common form, but it's just one technique. Dynamic analysis also includes: taint analysis (tracking how data flows at runtime), concolic testing (symbolic execution combined with real execution), memory
Authentication Testing
OAuth security testing isn't about checking if login works. It's about verifying your implementation can't be abused to steal tokens, impersonate users, or hijack sessions. These are the attacks that happen to real applications, and every one of them is testable. This guide covers