nonfunctional

2 articles

• Aug 7, 2026

  Broken Access Control: How QA Tests Authorization (OWASP's #1 Risk)

  Broken access control is #1 in the OWASP Top 10, and QA can catch most of these holes without a pentester. A first-person take: IDOR, horizontal and vertical privilege escalation, forced browsing, testing on the backend (not the UI), a role matrix, and token tampering. With a checklist and the usual places it breaks.

• Jul 31, 2026

  Testing Restore From Backup: The Backup Nobody Ever Restored

  Everyone has backups — almost nobody tests the restore. A first-person take: why "backup completed successfully" guarantees nothing; what RTO and RPO are and why you measure them; what actually breaks during a restore (corrupt archive, wrong point in time, drifted schema, foreign environment, secrets); how to run a restore drill; and why you should monitor the restore, not the backup job. With a breakdown of the GitLab 2017 incident.