What problem does it solve? Verifying that a Nextcloud app is secure against common attack vectors and meets Dutch government security standards (BIO2/NIS2) requires systematic manual testing across many categories, which is slow and easy to skip. ## Core Features & Use Cases - RBAC and authorization testing: Verifies privilege escalation protection, horizontal access control, and correct use of Nextcloud annotations like @NoAdminRequired and @NoCSRFRequired. - Multi-tenancy isolation checks: Confirms that objects from one organization are invisible to users of another and that the organisation field is auto-stamped and cannot be overridden. - Injection and CORS/CSRF testing: Probes endpoints with XSS, SQL injection, and prototype pollution payloads, and validates CORS allowlists and CSRF token enforcement via browser and curl. - Use Case: Before releasing an OpenRegister change, run the security tester to produce a structured report with an overall risk rating, a vulnerability table with severities and remediations, and a PASS/FAIL result line for the apply-loop orchestrator. ## Quick Start Run the security test for the current change and save the report to the app's test-results directory.
