Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Test Automation
Role-based access control (RBAC) bugs are subtle and expensive. A viewer who can delete records, an admin whose permissions don't cascade to subresources, or a billing role that can access user PII — these bugs are invisible until someone exploits them. This guide shows how to build a systematic
Test Automation
Tenant isolation is the most critical security property of a multi-tenant SaaS application. A bug that allows Tenant A to read Tenant B's data is a catastrophic breach — and it's the kind of bug that standard happy-path tests never catch. This guide covers how to systematically
Snyk
Snyk scans your dependencies, container images, infrastructure-as-code, and source code for vulnerabilities and license violations. This guide covers CLI integration for Node.js and Python, pull request checks in GitHub Actions, container image scanning, and managing false positives with policy files. Key Takeaways Snyk finds vulnerabilities in transitive dependencies, not
Semgrep
Semgrep is a fast, syntax-aware static analysis tool that lets you write custom security rules in YAML using code patterns rather than regular expressions. This guide covers rule syntax, writing custom rules for your codebase, using community rulesets, CI integration, and reducing false positives through triage and rule refinement. Key
OWASP ZAP
OWASP ZAP is the most widely used open-source web application security scanner. This guide covers integrating ZAP's Docker-based full scan and API scanning into GitHub Actions CI/CD pipelines, configuring authentication for authenticated scans, and handling alert triage to keep pipelines actionable. Key Takeaways Run ZAP as Docker
Nuclei
Nuclei is a fast, template-driven vulnerability scanner that lets teams define custom checks in YAML and run them reproducibly against targets. This guide covers template syntax, writing custom templates for application-specific vulnerabilities, CI integration for regression testing, and responsible scanning and disclosure practices. Key Takeaways Nuclei templates are the unit
Testing
Row-Level Security (RLS) is PostgreSQL's mechanism for enforcing data access policies at the database layer. For multi-tenant SaaS applications, RLS is a powerful defense-in-depth tool — even if application-layer authorization has a bug, RLS prevents cross-tenant data leakage at the database level. But RLS policies themselves can have bugs.
Testing
Role-Based Access Control (RBAC) is the authorization layer that ensures users can only access what they're permitted to. Manual testing of RBAC is insufficient — authorization bugs are subtle, easy to miss, and have severe consequences. Automated RBAC tests verify every permission boundary systematically. This guide covers implementing automated
Testing
Privilege escalation occurs when a user gains access or capabilities beyond what they were granted. Vertical escalation is gaining a higher role (user → admin); horizontal escalation is accessing another user's resources at the same privilege level. Both are critical security vulnerabilities that automated testing must catch. This guide
Testing
Payment fraud takes many forms — card testing attacks, negative amount injection, currency confusion, duplicate charge races, and webhook replay. Standard happy-path payment tests don't catch these scenarios. This guide covers testing adversarial and edge-case payment flows that expose real fraud and reliability vulnerabilities. Card Testing Attack Prevention Card
Testing
OAuth 2.0 and OpenID Connect (OIDC) are the foundation of modern authorization. Testing them is challenging because they involve multiple parties (client, authorization server, resource server), time-sensitive tokens, and complex flows. Bugs in OAuth implementations lead to security vulnerabilities that are hard to detect manually. This guide covers testing
Testing
Multitenancy bugs are among the most dangerous in SaaS applications — a data leak between tenants can expose customer data to competitors, trigger regulatory penalties, and destroy trust. Testing tenant isolation systematically prevents these catastrophes. This guide covers multitenancy testing: verifying data isolation, testing API-level tenant boundaries, detecting cross-tenant data leakage,