What problem does it solve? Functional test suites prove the happy path works for authorized users but rarely verify that the application actually enforces its access control, session, and input-handling claims. This Skill gives testers a systematic, OWASP-informed workflow for security testing at a tester's depth, starting from a mandatory written authorization gate and ending with findings routed through the proper disclosure path. ## Core Features & Use Cases - Authorization Matrix: Builds a complete role-by-endpoint matrix verified at the API level, catching IDOR, horizontal and vertical escalation, method confusion, and mass assignment. - Session and Authentication Checks: Verifies logout invalidation, token rotation, cookie flags, lockout behaviour, and password reset token handling against what the application claims. - Safe Input and Data Exposure Observation: Sends inputs a validator should reject and observes responses for injection indicators, verbose errors, and data leakage, stopping at confirmation rather than exploitation. - Use Case: A new role is added to a multi-tenant SaaS product. Use this Skill to obtain written authorization, build the full role-by-endpoint matrix with synthetic accounts, verify every cell at the API, and report any cross-tenant findings through the security disclosure channel. ## Quick Start Ask the AI to run a security testing pass on your staging application, starting with the authorization gate and building an authorization matrix for all roles and endpoints.
