# \#security **URL:** https://club.ministryoftesting.com/tag/security/38.md [Latest](https://club.ministryoftesting.com/latest.md) · [Categories](https://club.ministryoftesting.com/categories.md) · [Tags](https://club.ministryoftesting.com/tags.md) --- ## [What do we call all latent and non-detectable bugs?](https://club.ministryoftesting.com/t/what-do-we-call-all-latent-and-non-detectable-bugs/87816)
**Author:** [@conrad.braam](https://club.ministryoftesting.com/u/conrad.braam)\ **Replies:** 3\ **Last updated:** [16 October 2026 08:03 UTC](https://club.ministryoftesting.com/t/what-do-we-call-all-latent-and-non-detectable-bugs/87816 "2026-10-16T08:03:25Z")
I’m talking about, essentially all the non-functional type bugs I think. Google lists things like Latent bugs, dormant bugs, heisenbugs, masked bugs, and zero-day bugs. Which is a great way to start. So I’m thinking abou… --- ## [If You're Not Writing Custom Nuclei Templates, You're Missing Out](https://club.ministryoftesting.com/t/if-youre-not-writing-custom-nuclei-templates-youre-missing-out/87839)
**Author:** [@aiden\_mystic](https://club.ministryoftesting.com/u/aiden_mystic)\ **Replies:** 0\ **Last updated:** [14 October 2026 13:01 UTC](https://club.ministryoftesting.com/t/if-youre-not-writing-custom-nuclei-templates-youre-missing-out/87839 "2026-10-14T13:01:08Z")
One thing I’ve learned in pentesting is that generic templates only get you so far. When you’re testing a specific application, custom Nuclei templates let you check for vulnerabilities that generic scans might miss. He… --- ## [Anyone exploring agentic pentesting for web apps and APIs yet?](https://club.ministryoftesting.com/t/anyone-exploring-agentic-pentesting-for-web-apps-and-apis-yet/87476)
**Author:** [@aiden\_mystic](https://club.ministryoftesting.com/u/aiden_mystic)\ **Replies:** 3\ **Last updated:** [25 June 2026 04:14 UTC](https://club.ministryoftesting.com/t/anyone-exploring-agentic-pentesting-for-web-apps-and-apis-yet/87476 "2026-06-25T04:14:38Z")
I’ve been spending some time recently testing the alpha version of an agentic pentesting setup we’ve been developing internally, and it’s been an interesting shift from the usual automated scanning approach. One thing t… --- ## [What security threats can you spot in the "We Are Angry" system?](https://club.ministryoftesting.com/t/what-security-threats-can-you-spot-in-the-we-are-angry-system/86838)
**Author:** [@oxygenaddict](https://club.ministryoftesting.com/u/oxygenaddict)\ **Replies:** 3\ **Last updated:** [12 November 2025 11:48 UTC](https://club.ministryoftesting.com/t/what-security-threats-can-you-spot-in-the-we-are-angry-system/86838 "2025-11-12T11:48:53Z")
Threat modelling is about thinking like an attacker to find vulnerabilities in your system. It helps you understand how a system works, how data moves through it, and where things might go wrong. I’ve created a task to … --- ## [Have you tried exploring URLs as part of your testing?](https://club.ministryoftesting.com/t/have-you-tried-exploring-urls-as-part-of-your-testing/86836)
**Author:** [@oxygenaddict](https://club.ministryoftesting.com/u/oxygenaddict)\ **Replies:** 3\ **Last updated:** [29 October 2025 18:30 UTC](https://club.ministryoftesting.com/t/have-you-tried-exploring-urls-as-part-of-your-testing/86836 "2025-10-29T18:30:17Z")
URLs are a small but powerful part of every web application. They connect users to pages, define actions, and sometimes reveal more than developers expect. Changing or inspecting a URL can help you understand how a syst… --- ## [What areas of security testing are most important in your work?](https://club.ministryoftesting.com/t/what-areas-of-security-testing-are-most-important-in-your-work/86835)
**Author:** [@oxygenaddict](https://club.ministryoftesting.com/u/oxygenaddict)\ **Replies:** 4\ **Last updated:** [29 October 2025 11:46 UTC](https://club.ministryoftesting.com/t/what-areas-of-security-testing-are-most-important-in-your-work/86835 "2025-10-29T11:46:38Z")
Security is about protecting what matters to us. That could be customer information, your company’s intellectual property, or making sure your systems stay online and usable. In cybersecurity, this often ties back to th… --- ## [Burp Suite relevant for QA engineers transitioning from manual testing?](https://club.ministryoftesting.com/t/burp-suite-relevant-for-qa-engineers-transitioning-from-manual-testing/86795)
**Author:** [@checkout\_champion](https://club.ministryoftesting.com/u/checkout_champion)\ **Replies:** 9\ **Last updated:** [21 October 2025 18:08 UTC](https://club.ministryoftesting.com/t/burp-suite-relevant-for-qa-engineers-transitioning-from-manual-testing/86795 "2025-10-21T18:08:58Z")
I’m currently a manual software tester looking to “shift left” into a broader QA engineering role. I’m exploring tools that could expand my skill set, and Burp Suite caught my attention. Would learning Burp Suite be a w… --- ## [What everyday specialist techniques help you find hidden bugs?](https://club.ministryoftesting.com/t/what-everyday-specialist-techniques-help-you-find-hidden-bugs/86301)
**Author:** [@marie.drake](https://club.ministryoftesting.com/u/marie.drake)\ **Replies:** 2\ **Last updated:** [11 August 2025 08:58 UTC](https://club.ministryoftesting.com/t/what-everyday-specialist-techniques-help-you-find-hidden-bugs/86301 "2025-08-11T08:58:55Z")
In my testing, I’ve found that applying simple specialist techniques can uncover critical risks that might otherwise slip through. You don’t need to be an expert to make a difference; simple checks in areas like accessib… --- ## [Can you simply explain a web security risk you think testers should know about?](https://club.ministryoftesting.com/t/can-you-simply-explain-a-web-security-risk-you-think-testers-should-know-about/86040)
**Author:** [@sarahdeery](https://club.ministryoftesting.com/u/sarahdeery)\ **Replies:** 14\ **Last updated:** [9 August 2025 07:49 UTC](https://club.ministryoftesting.com/t/can-you-simply-explain-a-web-security-risk-you-think-testers-should-know-about/86040 "2025-08-09T07:49:26Z")
toptal.com list these as the 10 Common Web Security Vulnerabilities Injection Flaws Broken Authentication Cross-Site Scripting (XSS) Insecure Direct Object References (IDOR) Security Misconfiguration Sensitive Data Exp… --- ## [Security Testing - How involved are you in this?](https://club.ministryoftesting.com/t/security-testing-how-involved-are-you-in-this/85387)
**Author:** [@melissafisher](https://club.ministryoftesting.com/u/melissafisher)\ **Replies:** 7\ **Last updated:** [23 June 2025 08:40 UTC](https://club.ministryoftesting.com/t/security-testing-how-involved-are-you-in-this/85387 "2025-06-23T08:40:22Z")
Hey! I was wondering how involved you are in security testing? A lot of companies I’ve worked for have separate security teams. Is this the same for you? --- ## [How do you see prompt injections in terms of risk?](https://club.ministryoftesting.com/t/how-do-you-see-prompt-injections-in-terms-of-risk/84691)
**Author:** [@parwalrahul](https://club.ministryoftesting.com/u/parwalrahul)\ **Replies:** 3\ **Last updated:** [15 May 2025 17:44 UTC](https://club.ministryoftesting.com/t/how-do-you-see-prompt-injections-in-terms-of-risk/84691 "2025-05-15T17:44:00Z")
Prompt injection is emerging as a critical concern as more and more LLM-powered features are being integrated into real-world products. From chatbots to code assistants, the surface area for malicious or unintended prom… --- ## [How do you test cookies to balance security and user experience?](https://club.ministryoftesting.com/t/how-do-you-test-cookies-to-balance-security-and-user-experience/81641)
**Author:** [@sarahdeery](https://club.ministryoftesting.com/u/sarahdeery)\ **Replies:** 1\ **Last updated:** [17 December 2024 16:46 UTC](https://club.ministryoftesting.com/t/how-do-you-test-cookies-to-balance-security-and-user-experience/81641 "2024-12-17T16:46:10Z")
Check out our latest article by @mirza , “All About Application Cookies: Software Tester Edition,” to gain a clear understanding of cookies and their impact on privacy and user experience. Whether you’re testing session… --- ## [Advent of Cyber 2024 - Anyone joining?](https://club.ministryoftesting.com/t/advent-of-cyber-2024-anyone-joining/80911)
**Author:** [@kristof](https://club.ministryoftesting.com/u/kristof)\ **Replies:** 2\ **Last updated:** [19 November 2024 06:55 UTC](https://club.ministryoftesting.com/t/advent-of-cyber-2024-anyone-joining/80911 "2024-11-19T06:55:16Z")
Hii, I know some of you have heard of the Advent of Code, a programming challenge before Christman in the month of December. But those who are interested in learning more about Cyber Security, I would advise to check o… --- ## [Community Champions, who are yours?](https://club.ministryoftesting.com/t/community-champions-who-are-yours/78811)
**Author:** [@fullsnacktester](https://club.ministryoftesting.com/u/fullsnacktester)\ **Replies:** 2\ **Last updated:** [4 November 2024 16:23 UTC](https://club.ministryoftesting.com/t/community-champions-who-are-yours/78811 "2024-11-04T16:23:35Z")
The testing community has many great people, who I’ve become to know well for certain topics. Want to know more about security? My thoughts goto Daniel Billing and Richard Adams Want to know more about exploratory test… --- ## [Security testing online tutorial thing](https://club.ministryoftesting.com/t/security-testing-online-tutorial-thing/66898)
**Author:** [@oxygenaddict](https://club.ministryoftesting.com/u/oxygenaddict)\ **Replies:** 7\ **Last updated:** [8 October 2024 08:57 UTC](https://club.ministryoftesting.com/t/security-testing-online-tutorial-thing/66898 "2024-10-08T08:57:24Z")
Around 6 months ago I put together an online exercise that was intended to help people learn a few basics in security testing and used it as part of a mini workshop as part of my work. Long story short, after much delibe… --- ## [How often do you consider security vulnerabilities when designing and executing your test cases?](https://club.ministryoftesting.com/t/how-often-do-you-consider-security-vulnerabilities-when-designing-and-executing-your-test-cases/79927)
**Author:** [@aj\_wilson](https://club.ministryoftesting.com/u/aj_wilson)\ **Replies:** 2\ **Last updated:** [2 October 2024 05:08 UTC](https://club.ministryoftesting.com/t/how-often-do-you-consider-security-vulnerabilities-when-designing-and-executing-your-test-cases/79927 "2024-10-02T05:08:40Z")
In the spirit of Cybersecurity Awareness Month, here’s a question to ponder, how often do you consider security vulnerabilities when designing and executing your test cases? poll Bonus security points for your thoughts … --- ## [Breaking news: Crowdstrike Microsoft IT outage latest - Crowdstrike Windows glitch sparks global chaos as airlines, banks and Sky News go down](https://club.ministryoftesting.com/t/breaking-news-crowdstrike-microsoft-it-outage-latest-crowdstrike-windows-glitch-sparks-global-chaos-as-airlines-banks-and-sky-news-go-down/77841)
**Author:** [@simon\_tomes](https://club.ministryoftesting.com/u/simon_tomes)\ **Replies:** 30\ **Last updated:** [24 September 2024 16:04 UTC](https://club.ministryoftesting.com/t/breaking-news-crowdstrike-microsoft-it-outage-latest-crowdstrike-windows-glitch-sparks-global-chaos-as-airlines-banks-and-sky-news-go-down/77841 "2024-09-24T16:04:15Z")
:purple\_heart: Hugops to everyone involved in dealing with the global outage related to Microsoft/Crowdstrike. Microsoft IT outage latest - Windows glitch sparks global chaos as airlines, banks and Sky News go down Tha… --- ## [Rest API security testing: Is there any learning material out there for ZAP?](https://club.ministryoftesting.com/t/rest-api-security-testing-is-there-any-learning-material-out-there-for-zap/77826)
**Author:** [@hananurrehman](https://club.ministryoftesting.com/u/hananurrehman)\ **Replies:** 8\ **Last updated:** [24 July 2024 12:24 UTC](https://club.ministryoftesting.com/t/rest-api-security-testing-is-there-any-learning-material-out-there-for-zap/77826 "2024-07-24T12:24:07Z")
So I started diving into API security as part of my larger effort to get around API testing but I see there’s a lack of resources. The tutorials for ZAP on youtube either just scratch the surface or are not related to wh… --- ## [Snyk (SAST) Where to focus as a test manager?](https://club.ministryoftesting.com/t/snyk-sast-where-to-focus-as-a-test-manager/76967)
**Author:** [@spaniardnorge](https://club.ministryoftesting.com/u/spaniardnorge)\ **Replies:** 1\ **Last updated:** [3 June 2024 19:28 UTC](https://club.ministryoftesting.com/t/snyk-sast-where-to-focus-as-a-test-manager/76967 "2024-06-03T19:28:54Z")
Hello, as many of you know, Snyk is a tool that helps developers find and fix vulnerabilities in their code (SAST). I was wondering which ones are the aspects/responsabilities of a person with the role;test responsible … --- ## [What challenges have you faced in testing SSN validation in your projects?](https://club.ministryoftesting.com/t/what-challenges-have-you-faced-in-testing-ssn-validation-in-your-projects/76194)
**Author:** [@sarahdeery](https://club.ministryoftesting.com/u/sarahdeery)\ **Replies:** 1\ **Last updated:** [7 May 2024 08:45 UTC](https://club.ministryoftesting.com/t/what-challenges-have-you-faced-in-testing-ssn-validation-in-your-projects/76194 "2024-05-07T08:45:15Z")
Read our latest article, " Social Security Number Validation: A Tester’s Guide to Uncovering Hidden Defects" by @natebosscher, an in-depth look at the challenges and methods used in validating SSNs in software applicatio… --- ## [Is there any demand for a specifically crafted guide on web cybersecurity for QA and Testers?](https://club.ministryoftesting.com/t/is-there-any-demand-for-a-specifically-crafted-guide-on-web-cybersecurity-for-qa-and-testers/76000)
**Author:** [@shad0wpuppet](https://club.ministryoftesting.com/u/shad0wpuppet)\ **Replies:** 5\ **Last updated:** [24 April 2024 21:00 UTC](https://club.ministryoftesting.com/t/is-there-any-demand-for-a-specifically-crafted-guide-on-web-cybersecurity-for-qa-and-testers/76000 "2024-04-24T21:00:06Z")
I’m working on writing some kind of a handbook (probably longer than 30 google doc pages) for QA and testers, created by a QA Engineer for QA Engineers :sweat\_smile: Not sure if there’s much interest out there on this to… --- ## [🤖 Day 25: Explore AI-driven security testing and share potential use cases](https://club.ministryoftesting.com/t/day-25-explore-ai-driven-security-testing-and-share-potential-use-cases/75365)
**Author:** [@billmatthews](https://club.ministryoftesting.com/u/billmatthews)\ **Replies:** 18\ **Last updated:** [14 April 2024 15:47 UTC](https://club.ministryoftesting.com/t/day-25-explore-ai-driven-security-testing-and-share-potential-use-cases/75365 "2024-04-14T15:47:41Z")
Day 25 is all about Security Testing. If you’ve ever tried your hand at Application Security Testing, you’ll know that it’s a complex and evolving topic that usually requires in-depth technical knowledge. Various tools e… --- ## [Sharing knowledge in cybersecurity for QA and Testers](https://club.ministryoftesting.com/t/sharing-knowledge-in-cybersecurity-for-qa-and-testers/75452)
**Author:** [@shad0wpuppet](https://club.ministryoftesting.com/u/shad0wpuppet)\ **Replies:** 2\ **Last updated:** [25 March 2024 23:15 UTC](https://club.ministryoftesting.com/t/sharing-knowledge-in-cybersecurity-for-qa-and-testers/75452 "2024-03-25T23:15:55Z")
I wrote several articles on cybersecurity for QA and Testers (and more posts on LI on this topic) about XSS, cybersecurity vulnerability scanners, essentials in web security testing for QA Engineers, rate limiting and br… --- ## [How does another leaky API story help you and your team?](https://club.ministryoftesting.com/t/how-does-another-leaky-api-story-help-you-and-your-team/73864)
**Author:** [@simon\_tomes](https://club.ministryoftesting.com/u/simon_tomes)\ **Replies:** 2\ **Last updated:** [6 February 2024 12:41 UTC](https://club.ministryoftesting.com/t/how-does-another-leaky-api-story-help-you-and-your-team/73864 "2024-02-06T12:41:45Z")
Here’s another leaky API story. Stories like this always make me think about how teams can build with these security risks in mind. How does your team use real-life incidents to reflect on their existing Info Sec & … --- ## [Testing in the Browser?](https://club.ministryoftesting.com/t/testing-in-the-browser/73355)
**Author:** [@natebosscher](https://club.ministryoftesting.com/u/natebosscher)\ **Replies:** 14\ **Last updated:** [18 January 2024 20:34 UTC](https://club.ministryoftesting.com/t/testing-in-the-browser/73355 "2024-01-18T20:34:47Z")
I’m interested in helping people test better and more efficiently when they’re in the browser. Looking around the internet and at companies I’ve been at, I find that people are often: using a very narrow set of test ca… --- ## [Advent of Cyber 2023](https://club.ministryoftesting.com/t/advent-of-cyber-2023/71993)
**Author:** [@kristof](https://club.ministryoftesting.com/u/kristof)\ **Replies:** 3\ **Last updated:** [30 November 2023 14:58 UTC](https://club.ministryoftesting.com/t/advent-of-cyber-2023/71993 "2023-11-30T14:58:37Z")
I’m super hyped for the Advent of Cyber 2023. Since I saw many questions lately about getting into Security testing, I’m going to tag a few people here, this is a really good opportunity to learn about some topics in Cyb… --- ## [Cyber vulnerability](https://club.ministryoftesting.com/t/cyber-vulnerability/72277)
**Author:** [@spaniardnorge](https://club.ministryoftesting.com/u/spaniardnorge)\ **Replies:** 2\ **Last updated:** [28 November 2023 06:55 UTC](https://club.ministryoftesting.com/t/cyber-vulnerability/72277 "2023-11-28T06:55:10Z")
Hello everyone, what kind of testing do you think is necessary in the case of cyber vulnerabilities such as 4jlog? What would be the test strategy here? --- ## [Any recommendations for OWASP free webinars or conferences?](https://club.ministryoftesting.com/t/any-recommendations-for-owasp-free-webinars-or-conferences/71953)
**Author:** [@aurelienl](https://club.ministryoftesting.com/u/aurelienl)\ **Replies:** 5\ **Last updated:** [21 November 2023 17:46 UTC](https://club.ministryoftesting.com/t/any-recommendations-for-owasp-free-webinars-or-conferences/71953 "2023-11-21T17:46:13Z")
As a QA professional aiming to enhance my expertise in security testing, I’m seeking recommendations from the community for OWASP free webinars or conferences that could contribute to my learning. While I’ve discovered … --- ## [Security Testing - Where on earth do you start?](https://club.ministryoftesting.com/t/security-testing-where-on-earth-do-you-start/55855)
**Author:** [@chris.adams](https://club.ministryoftesting.com/u/chris.adams)\ **Replies:** 15\ **Last updated:** [16 November 2023 16:02 UTC](https://club.ministryoftesting.com/t/security-testing-where-on-earth-do-you-start/55855 "2023-11-16T16:02:43Z")
Hi, I’ve been a tester for around 12 years now. I’ve got experience in API testing, UI Automation, Load Testing, Performance Testing etc. but I haven’t done any Security Testing. I’ve bought a couple of books a while … --- ## [Why should we invest our time in doing security testing?](https://club.ministryoftesting.com/t/why-should-we-invest-our-time-in-doing-security-testing/71747)
**Author:** [@dianadromey](https://club.ministryoftesting.com/u/dianadromey)\ **Replies:** 2\ **Last updated:** [14 November 2023 07:04 UTC](https://club.ministryoftesting.com/t/why-should-we-invest-our-time-in-doing-security-testing/71747 "2023-11-14T07:04:27Z")
Richard Adams (@oxygenaddict )spoke at TestBash UK 2023 on how security testing should be something we can and should be doing every day. So we invite you to watch his talk and use this Club thread to: Share what y… [Next page](https://club.ministryoftesting.com/tag/security/38.md?match_all_tags=true&page=1&tags%5B%5D=security)