Test Automation
OSS-Fuzz: Integrating Continuous Fuzzing into Open Source Projects
Since its launch in 2016, Google's OSS-Fuzz program has found over 10,000 vulnerabilities and bugs in more than 1,000 open source projects.
Security Testing
Security testing guides — vulnerability scanning, penetration testing basics, and secure SDLC practices.
Latest
Test Automation
Jazzer: Coverage-Guided Java/JVM Fuzzing in CI Pipelines
Java has a reputation for safety — garbage collection eliminates entire classes of memory bugs, strong typing prevents many type errors, and the JVM sandboxes execution. But Java applications can still have serious bugs: path traversal vulnerabilities in file handling, deserialization exploits, XML/JSON parsing crashes, SQL injection through improperly sanitized
Test Automation
ClusterFuzz: Google's Distributed Fuzzing Infrastructure for CI
OSS-Fuzz handles the hosting and infrastructure for open source projects. But what runs underneath OSS-Fuzz?
Test Automation
cargo-fuzz + libFuzzer: Rust Continuous Fuzzing in GitHub Actions
Rust's ownership system and borrow checker eliminate entire categories of memory safety bugs at compile time — but they cannot prevent all bugs.
Test Automation
Atheris: Python Fuzzing with libFuzzer for Automated Vulnerability Discovery
Python's dynamic type system and exception handling make it easier to write code that handles invalid input gracefully — in theory.
Test Automation
Testing RBAC in SaaS Applications with Playwright and Jest
Role-based access control (RBAC) bugs are subtle and expensive. A viewer who can delete records, an admin whose permissions don't cascade to subresources, or a billing role that can access user PII — these bugs are invisible until someone exploits them. This guide shows how to build a
Test Automation
Multi-Tenant SaaS Testing: Tenant Isolation and Data Segregation Tests
Tenant isolation is the most critical security property of a multi-tenant SaaS application.
Snyk
Snyk Dependency Scanning: Automated Vulnerability Testing in PRs and CI
Supply chain attacks and vulnerable dependencies have become one of the most common entry points for security breaches.
Semgrep
Semgrep SAST: Writing Custom Rules and Integrating Static Analysis in CI
Semgrep is a fast, syntax-aware static analysis tool that lets you write custom security rules in YAML using code patterns rather than regular expressions. This guide covers rule syntax, writing custom rules for your codebase, using community rulesets, CI integration, and reducing false positives through triage and rule refinement.
OWASP ZAP
OWASP ZAP Automated Security Testing: CI/CD Integration and API Scanning
OWASP ZAP (Zed Attack Proxy) has been the go-to open-source DAST (Dynamic Application Security Testing) tool for over a decade.
Nuclei
Nuclei Vulnerability Scanning: Custom Templates and Responsible Disclosure
Nuclei, developed by ProjectDiscovery, has become the dominant tool in the bug bounty and penetration testing community for scalable vulnerability scanning.
Testing
Row-Level Security Testing in PostgreSQL for Multi-Tenant SaaS
Row-Level Security (RLS) is PostgreSQL's mechanism for enforcing data access policies at the database layer.