Testing & security
Test real failure modes, enforce authorization, and protect full-stack and AI features against abuse.
Showing 1–10 of 10 articles
Create a threat model for an AI enabled full stack feature
Threat-model an AI feature by tracing untrusted inputs, retrieval, tool authority, tenant boundaries, and consequential outputs into testable abuse cases.
Run end to end tests without touching production customer data
Run end-to-end checks with isolated environments, synthetic accounts, safe providers, explicit target guards, and cleanup that remains reliable after failure.
Design rate limits around account abuse and provider costs
Limit abusive and expensive operations with deliberate keys, atomic shared counters, separate cost budgets, clear retry behavior, and failure-policy tests.
Revoke sessions after account deletion or credential recovery
Make account deletion and credential recovery invalidate existing access through explicit session state, token lifetimes, current identity checks, and revocation tests.
Prevent cross site scripting in rich text and structured data
Protect rich text and embedded structured data at their distinct rendering boundaries with sanitization, safe serialization, and malicious synthetic cases.
Review AI generated tests for false confidence
Challenge AI-generated tests with plausible wrong implementations, meaningful assertions, realistic fixtures, and honest evidence of what actually ran.
Use provider doubles without mistaking them for integration tests
Use provider doubles to test application behavior while keeping real protocol, authentication, timeout, and delivery guarantees explicitly unverified.
Test a race condition without relying on a lucky manual reproduction
Reproduce concurrency defects with controlled barriers and real storage boundaries, then assert the business invariant rather than relying on lucky timing.
Build role based API tests for anonymous users and administrators
Test API roles with explicit allow and deny cases, cross-owner resources, field visibility, and unchanged state so hidden UI controls cannot mask access gaps.
Choose a regression test that would fail before your fix
Choose a regression test from the original symptom, prove it fails for the right reason, and assert behavior rather than private implementation details.
Explore topics
Subscribe to Newsletter
Get the latest articles and updates delivered to your inbox.