WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 29, 2024 • Session details

It's a (testing) trap! - Common testing pitfalls and how to solve them

Ramona Schwering

Your end-to-end tests are secretly your best security tools. Discover how to repurpose Cypress and Playwright into automated defenders against critical OWASP vulnerabilities.

Pause
Mute Enter Fullscreen
#1 about 6 min

Conceptualizing app security defense using gaming mechanics

Visualizing web application vulnerabilities and their mitigation measures through the strategic mechanics of tower defense games.

#2 about 2 min

Identifying common security vulnerabilities via the OWASP project

Prioritizing testing efforts by referencing open source analytics that define the most prevalent and hazardous internet threats.

#3 about 2 min

Isolating cross-site scripting issues using automated component tests

Simulating adversarial behavior by injecting script payloads into test inputs to ensure interfaces properly discard dangerous strings.

#4 about 4 min

Verifying API response rules and content security policy

Requesting forbidden actions and capturing header objects with robust tooling to check resource permissions and distinct origin validation.

#5 about 2 min

Defending against broken access control with negative testing

Covering expected authentication paths alongside intentional negative workflows to ensure private zones adequately reject unauthenticated queries.

#6 about 1 min

Executing fundamental runtime tests against cryptographic failures

Safeguarding data transit efficiently by configuring natively bundled test framework routines to explicitly fail on unencrypted connections.

#7 about 4 min

Addressing unseen code weaknesses using complementary security pipelines

Integrating standard static analysis tooling alongside codebase scanning extensions to protect backend components beyond generic end-to-end constraints.

#8 about 4 min

Deploying structural security analysis within general testing workflows

Building a comprehensive quality assurance pipeline by prioritizing typical vulnerabilities before systematically enforcing broad automated constraints.

#9 about 3 min

Bolstering test coverage consistently without specialized security frameworks

Defending expansive application requirements practically by executing simplified interactions alongside designated internal architectural mitigations.

#10 about 1 min

Encouraging broader team adoption of security automation practices

Protecting continuous delivery and developer focus by permanently migrating repeated manual vulnerability checks into scheduled automated pipeline routines.

Matching moments

2:33 min

Introduction to security advocacy and automation testing

Chris Heilmann +2 · LIVE

4:00 min

Evolution from manual hacking to automated security testing

Chris Wysopal Chris Wysopal · WWC 2024

2:39 min

Shifting security testing focus toward critical application logic problems

Julian Totzek-Hallhuber Julian Totzek-Hallhuber · WWC Europe 2026

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

4:35 min

Improving developer education with realistic security training environments

Joseph Katsioloudes Joseph Katsioloudes · WWC 2025

2:49 min

Integrating fundamental security evaluations into agile development sprints

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
10 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
almost 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
almost 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
almost 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
almost 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Red Teaming Your LLM App -- A Hands-On Threat Model You Can Reuse

Saloni Garg

Senior ML Engineer at Adobe

Saloni Garg
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

Reinventing Testing Practices in the AI Era

Eric Deandrea

Java Champion & Senior Principal Software Engineer, IBM

Eric Deandrea

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
WWC 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot thumbnail
22:56
WWC Europe 2026 • about 1 month ago

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot

Malte Lantin, Marie Theresa Brosig

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
WWC 2025 • 12 months ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

One-click-to-production: Test and automate your application thumbnail
31:15
WWC 2022 • about 4 years ago

One-click-to-production: Test and automate your application

Bartosz Pietrucha

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.