📚 Security Testing Basics

QA engineers don't need to become AppSec specialists to catch common security issues. Learn practical security threats (XSS, authorization bugs, IDOR, secrets leaks) and a lightweight checklist for.

Run OWASP ZAP against a staging build, then keep only the findings a developer can act on.

Find access-control bugs a scanner misses: a swapped object id, a lower role, and another user's data in the response.

Check that logout kills the session, cookies are flagged, and a cross-site POST cannot ride the user's cookie.

Put secret scanning, dependency review, and a ZAP baseline in CI. Fail the build only on findings you already treat as release blockers.