Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Testing
APIs are the backbone of modern applications. They are also the primary attack surface. While web application security testing has decades of tooling and methodology behind it, API security testing is often treated as an afterthought — a Postman collection with some happy path tests and nothing more. This guide changes
LLM Testing
Most LLM security testing is manual: a human tries to jailbreak the model, documents what worked, and moves on. That approach doesn't scale and doesn't catch regressions when you swap models or update system prompts. Garak is an open-source LLM vulnerability scanner that automates this process
Security Testing
The Sarbanes-Oxley Act (SOX) requires public companies to maintain accurate financial reporting and demonstrate effective internal controls. For software teams, SOX compliance translates to specific IT General Controls (ITGCs) that can — and should — be automated. SOX and IT General Controls SOX Section 404 requires management to assess and attest to
Security Testing
The NIST Cybersecurity Framework (CSF) provides a flexible structure for managing cybersecurity risk. Unlike FIPS 140 or SOX, the CSF is not prescriptive — it describes outcomes, not specific controls. This makes it adaptable but also harder to test against. This guide maps CSF functions and categories to concrete automated tests.
Security Testing
FIPS 140-2 (and its successor FIPS 140-3) defines security requirements for cryptographic modules used in federal systems. If your application handles sensitive government data or pursues FedRAMP authorization, you need to use FIPS-validated cryptographic modules. Testing verifies your code actually uses them. What FIPS 140-2/3 Requires FIPS 140-2 defines
Security Testing
ISO 27001 is the international standard for information security management systems (ISMS). Certification requires demonstrating that security controls are implemented, tested, and continuously monitored. For developers, this translates to a specific set of testing responsibilities — most of which can be automated. What ISO 27001 Requires Developers to Test ISO 27001
Security Testing
FedRAMP (Federal Risk and Authorization Management Program) is the U.S. federal government's standard for cloud service security. If your product serves federal agencies, FedRAMP authorization is required. The security testing requirements are among the most rigorous in any compliance framework — and a significant portion can be automated.
Test Automation
Since its launch in 2016, Google's OSS-Fuzz program has found over 10,000 vulnerabilities and bugs in more than 1,000 open source projects. It runs fuzzing continuously, 24 hours a day, across billions of CPU-core-hours of compute. When it finds a crash, it automatically files an issue,
Test Automation
Java has a reputation for safety — garbage collection eliminates entire classes of memory bugs, strong typing prevents many type errors, and the JVM sandboxes execution. But Java applications can still have serious bugs: path traversal vulnerabilities in file handling, deserialization exploits, XML/JSON parsing crashes, SQL injection through improperly sanitized
Test Automation
OSS-Fuzz handles the hosting and infrastructure for open source projects. But what runs underneath OSS-Fuzz? The answer is ClusterFuzz — Google's distributed fuzzing platform that scales across thousands of machines, automatically manages corpora, deduplicates crashes, minimizes test cases, and integrates with bug trackers. ClusterFuzz is open source and can
Test Automation
Rust's ownership system and borrow checker eliminate entire categories of memory safety bugs at compile time — but they cannot prevent all bugs. Logic errors, integer overflows (in release mode), incorrect invariant assumptions, panics on unexpected input, and subtle algorithmic mistakes are all still possible. cargo-fuzz brings libFuzzer'
Test Automation
Python's dynamic type system and exception handling make it easier to write code that handles invalid input gracefully — in theory. In practice, Python libraries that parse formats, process untrusted data, or call into native extensions can crash, hang, or exhibit undefined behavior just like C code. Atheris brings