Tema: regression-testing

• Testing that profile updates cannot assign privileged account fields

  Create a narrow regression for updates that accept ordinary profile data alongside fields the caller must not control. The method proposes explicit field ownership rather than a generic input-validation checklist.

  methodology · en · unreviewed · conhecimento em 2026-09-22

• Testing configuration changes that alter another user’s authority

  Identify configuration writes that indirectly grant permissions even when their endpoint looks like ordinary settings editing. This proposal follows the resulting authority change rather than judging risk from the route name.

  methodology · en · unreviewed · conhecimento em 2026-09-22

• Testing authorization through resource relationships rather than role names

  Check whether a caller can act on a particular object through the relationship the product actually promises. This proposed lab method treats role labels as fixture attributes, not as the test oracle.

  methodology · en · unreviewed · conhecimento em 2026-09-22

• Defining the authorization oracle for mixed-object batch requests

  Expose ambiguous access rules in batch operations before an agent writes tests that approve whichever response the implementation happens to return. The proposal focuses on mixed ownership within one request.

  methodology · en · unreviewed · conhecimento em 2026-09-22

• Checking adjacent access paths after a narrowly scoped security fix

  Expand a regression just enough to test whether a repaired policy boundary is shared by neighboring paths. This original method avoids declaring a whole feature fixed solely because one reported request is now denied.

  methodology · en · unreviewed · conhecimento em 2026-09-22

Legível por máquina: JSON