OWASP Top 10 Coverage

Security Testing

VibeQA tests your app against the OWASP Top 10, common attack vectors, and real-world vulnerability patterns. Every test run includes security scanning — no setup required.

Coverage

What we test

Each scan maps directly to OWASP Top 10 categories. These aren't theoretical — they're the vulnerabilities that appear in real production apps every day.

Injection

A03:2021
  • SQL injection via form inputs and URL parameters
  • NoSQL injection patterns (MongoDB operator injection)
  • Command injection in search fields and file paths
  • LDAP injection in authentication forms

Broken Authentication

A07:2021
  • Tests login flows with empty and malformed credentials
  • Session token handling after logout (token invalidation)
  • Password reset flow enumeration and token reuse
  • Brute-force protection — rate limiting on auth endpoints

Cross-Site Scripting (XSS)

A03:2021
  • Injects <script> tags in every text input and textarea
  • Event handler payloads: onerror, onload, onfocus, onmouseover
  • Encoded payloads (HTML entities, URL encoding, Unicode)
  • DOM-based XSS via URL fragments and query parameters

Insecure Direct Object References

A01:2021
  • API endpoint testing with modified resource IDs
  • Horizontal privilege escalation (accessing other users' data)
  • Sequential ID enumeration on REST endpoints
  • GraphQL query manipulation for unauthorized field access

Security Misconfiguration

A05:2021
  • Exposed .env files, .git directories, and config files
  • Debug endpoints (/debug, /status, /health with sensitive data)
  • Default credentials on admin panels
  • Permissive CORS headers (Access-Control-Allow-Origin: *)

Sensitive Data Exposure

A02:2021
  • Scans client-side code for hardcoded API keys and secrets
  • Checks for tokens stored in localStorage / sessionStorage
  • Unencrypted data in network requests (HTTP vs HTTPS)
  • Sensitive data leaking in error messages and stack traces
Process

How security scanning works

The agent runs a full security scan on every test run. Here's what happens under the hood.

01

Surface discovery

Agent identifies all input fields, URL parameters, query strings, and API endpoints across your application.

02

Payload injection

For each input surface, the agent tries 47 different attack payloads — covering SQL, XSS, command injection, and path traversal vectors.

03

Response monitoring

It monitors the DOM, browser console, and network responses for signs of successful injection — unescaped output, error disclosure, or unexpected data return.

04

Severity classification

If a payload executes or returns unexpected data, it's flagged with a severity level, reproduction steps, and a concrete fix recommendation.

Classification

Severity levels

Every finding is classified by severity so you know what to fix first. Levels follow CVSS conventions.

Critical

Examples: XSS execution, SQL injection, authentication bypass

Exploitable in production. Fix immediately.

High

Examples: Exposed API keys, missing CORS restrictions, debug endpoints

Security risk. Fix before deploy.

Medium

Examples: Missing CSP headers, weak session configuration, open redirects

Should be fixed. Low immediate risk.

Low

Examples: Missing security headers (X-Frame-Options), HTTP vs HTTPS links

Best practice. Fix when possible.

Output

Example security report

When VibeQA finds a vulnerability, you get the payload, the evidence, the impact, and a concrete code fix — not a vague warning.

vibeqa — security-report.log
CRITICAL: Cross-Site Scripting (XSS)
Location:  /search?q=<payload>
Payload:   <img src=x onerror=alert(1)>
Evidence:  Script executed in DOM
Impact:    Attacker can steal session tokens via document.cookie

Fix: Sanitize user input with DOMPurify or use
     textContent instead of innerHTML

     // Before (vulnerable)
     element.innerHTML = userInput;

     // After (safe)
     element.textContent = userInput;

Start security testing

Every test run includes OWASP Top 10 scanning out of the box. No configuration, no extra tools, no security expertise required.