Test-Driven Security
summary
Creator of PHPUnit uses a tiny Laravel + SQLite note app (≈400 lines) to show three concrete failures tied to CWE-89, CWE-79, CWE-285: SQL injection fixed by prepared statements, XSS exposed by unescaped output fixed by asserting absence of payload, and broken authorization fixed by abort_unless checks so only owners delete notes. Tests run red against the vulnerable app and turn green after the specific fixes, demonstrating tests-as-security-contracts and no extra tooling beyond the test suite.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker welcome
- 1:23Security as a testing problem
- 3:17Test-driven development for security
- 5:35CWE catalog and attack examples
- 6:58Demo application overview
- 8:12Running security tests in PHPUnit
- 9:01SQL injection vulnerability and fix
- 12:43Cross-site scripting vulnerability
- 18:02Improper authorization flaw
- 23:15Tests prevent vulnerabilities in production
- 24:53CWE top 20 and industry mistakes
- 26:07Key takeaways and closing remarks
- 27:19Q&A session
