17 articles
API security testing: OWASP API Top 10 coverage, vulnerability classes, authentication flaws, and the tooling that catches them before production.
The MCP threat model and the test cases that cover it — tool poisoning, confused deputy, token passthrough, session hijacking, DNS rebinding and excessive agency, with runnable assertions for each.
MCP versus REST from a testing point of view — protocol, contract discovery, caller behaviour, error channels, security surface and what your existing API test skills carry over unchanged.
A practical guide to testing Model Context Protocol servers — the handshake, tools/list and tools/call, schema assertions, error mapping, transport differences, and the security cases unique to MCP.
Enterprise API testing lives or dies on identity and secrets. Here is how SSO, role mapping, and runtime secret-manager integrations keep credentials out of test files and access under IdP control.
How JWT signing keys end up in test files, what the blast radius looks like, and the enterprise controls that prevent it. Pre-commit detection, CI scanning, vault integration, and key rotation patterns that hold up to audit.
How to design OAuth 2.0 negative test suites that catch real-world auth vulnerabilities across enterprise IdPs. PKCE mismatch, token reuse, scope escalation, and redirect-URI tampering with worked examples for Okta, Azure AD / Entra ID, and Ping Identity.
How enterprise security teams operationalize the OWASP API Security Top 10 (2023) as concrete SDL controls — not just a test checklist. Mitigation patterns, evidence per control, and the program structure that survives procurement and audit review.
Understand the key differences between API penetration testing and API security testing, when to use each approach, and how to combine them for complete API protection.
How to wire API security testing into an enterprise SDL — pre-commit, PR, release, and production-monitoring stages. Quality gates, evidence capture, and how the controls map to SOC 2, PCI-DSS, and ISO 27001.
