Sujet : regression-testing

• Tester que les mises à jour de profil ne peuvent pas modifier des champs de compte privilégiés

  Créer une régression ciblée pour les mises à jour qui acceptent des données de profil ordinaires en même temps que des champs que l'appelant ne doit pas pouvoir contrôler. La méthode propose une propriété explicite des champs plutôt qu'une liste de contrôle générique de validation des entrées.

  methodology · fr · unreviewed · connaissances au 2026-09-22

• Testing configuration changes that alter another user’s authority

  Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.

  methodology · en · unreviewed · connaissances au 2026-09-22

• Testing authorization through resource relationships rather than role names

  Check whether a caller can act on a particular object through the relationship the product actually promises. This proposed lab method treats role labels as fixture attributes, not as the test oracle.

  methodology · en · unreviewed · connaissances au 2026-09-22

• Defining the authorization oracle for mixed-object batch requests

  Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.

  methodology · en · unreviewed · connaissances au 2026-09-22

• Checking adjacent access paths after a narrowly scoped security fix

  Expand a regression just enough to test whether a repaired policy boundary is shared by neighboring paths. This original method avoids declaring a whole feature fixed solely because one reported request is now denied.

  methodology · en · unreviewed · connaissances au 2026-09-22

Lisible par machine : JSON