Find and fix weaknesses
Write security tests
Turn important abuse cases into repeatable tests for authorization, validation, secret handling, rate limits, and safe failure.
8 minute lesson
A security requirement becomes much stronger when a test proves it. Start with the failures that would hurt most.
Use two user identities for ownership tests. Send malformed and oversized input. Verify secrets never appear in public output. Exercise expired and revoked credentials. Keep these tests beside the behavior they protect.
A route test signs in Alice and confirms she can read her note. It never asks whether Bob can read the same note, so the missing ownership check stays invisible.
A 403 alone is weak evidence if the unauthorized update still reached a background job. Check the response, stored state, and emitted event.
Add a two-user test for one read and one mutation. Assert the denial, unchanged database state, and expected security event, then run the same test against an expired session.
Lesson completed