security
10 articles
-
How to Test a Mobile Game's Economy and Catch Cheaters
A game's economy is the prime target: every cheat hits revenue directly. A first-person take: why you can't trust the client (server authority), duplication bugs and purchase idempotency, device-clock manipulation, save-file editing, negative balance and overflow, fake IAP receipts, and cheat tools. With a checklist of attacks QA must run.
-
Broken Access Control: How QA Tests Authorization (OWASP's #1 Risk)
Broken access control is #1 in the OWASP Top 10, and QA can catch most of these holes without a pentester. A first-person take: IDOR, horizontal and vertical privilege escalation, forced browsing, testing on the backend (not the UI), a role matrix, and token tampering. With a checklist and the usual places it breaks.
-
Fuzz Testing: Breaking Input with Garbage to Find What You Can't Catch by Hand
Manual cases check what you thought of; bugs live where you didn't. A first-person take: what fuzzing is and why it has a different oracle (you catch the crash, not the "right answer"); the kinds — dumb, coverage-guided (AFL++/libFuzzer), property-based (Hypothesis/fast-check); where QA actually applies it (parsers, file upload, API by OpenAPI, input fields, business logic); what fuzzing finds that manual cases never do; tools and how to start so it lives in CI.
-
Payment & checkout testing checklist — the cases where money breaks
Checkout is where money and trust meet, yet it's usually tested with card 4242 and the happy path. A first-person take: money as integer minor units, not floats; double charges and idempotency; bank declines as normal, not a 500; 3-D Secure and the abandoned challenge; the webhook as source of truth, not the redirect; recomputing totals and promo codes on the server; PCI and tokenization; network drops at every step. Plus a flat 16-point checklist.
-
Rate limiting — how to test the limits everyone remembers only after an incident
While nobody is hammering the API, limits seem unnecessary — their absence is invisible right up until the first incident. A first-person take: the limit as a two-sided contract (the server restricts — the client survives it), the N/N+1 boundary and an honest 429 with Retry-After, key scope and how an account-based limit lets attackers DoS a victim, the burst at window boundaries, bypasses via X-Forwarded-For and sibling endpoints, the zones where a limit is mandatory (OTP, reset, promo codes), and why 'limits are off on staging' equals an untested production.
-
Registration & login testing checklist — with a Playwright autotest for every item
Login is the first screen a user sees and a favorite spot for production incidents. The "checklist item → how to automate it" format: user enumeration via identical error messages, password reset with a single-use token, logout and the back button, HttpOnly/Secure cookies via context.cookies(), sessions across two tabs, mocking 429 for lockout UI, the storageState pattern so you don't log in inside every test — and what parts of auth should never go into e2e.
-
File upload testing checklist: 30+ cases people forget
A reusable file upload testing checklist: content vs extension and magic bytes, sizes and decompression bombs, file names and path traversal, the upload process and dropped connections, server-side processing and storage, security (SVG XSS, RCE, SSRF) and accessibility. 30+ points.
-
Idempotency and retry storms — what QA must test in distributed systems
The most expensive class of bugs in payments isn't 'didn't go through' — it's 'went through twice'. A QA-eye view of idempotency: Idempotency-Key, 5 typical retry scenarios, retry storms, tools (WireMock, Toxiproxy, k6), and a 13-point release checklist.
-
CrowdStrike, July 2024 — how a single driver bricked 8.5 million Windows machines in 78 minutes
The most expensive software failure in history — $5.4B in direct losses. A trivial off-by-one on the side of an internal validator. Full timeline, root cause, three separate QA failures, and 10 lessons for your team.
-
OWASP API Security Top 10 for QA — a guide with test cases
Most QAs know SQL injection and XSS. But 90% of vulnerabilities in modern products live in APIs, and the OWASP API Top 10 2023 is a separate list that QA courses don't cover. All 10 threats with test cases, curl snippets, and tools.