Where the application works perfectly, including for the attacker.
A user suspects their account is compromised, so they change their password. Does that actually evict the attacker?
Any product with a login. Especially one with sessions, password reset, or multi-factor.
Password policy enforced on the server, not the form. Duplicate handling that does not confirm an account exists.
Error messages, timing, lockout — and why per-account rate limiting does nothing against credential stuffing.
Four properties a reset token needs, and the one check that matters most in the whole playbook.
Rate limiting, code reuse, and the bypass that cannot be found through the interface.
Expiry, rotation, fixation, and proving logout invalidates server-side rather than clearing a cookie.
Object-level and function-level. The one-minute check that finds the most commonly reported serious defect in web APIs.
A working application with 18 deliberate defects, each switchable on and off individually. Run a case, watch it fail, disarm the defect, run it again.
That second run is the point. Most testers have seen software fail. Very few have deliberately observed what a genuine pass looks like for a specific control — which is why juniors report defects that are not there.
Python, no installation beyond the interpreter.
The reasoning behind the cases. Why this domain fails differently, which checks matter most, how to report a finding so it gets fixed rather than filed, and the sign-off that turns a test run into a deliverable.
A filterable spreadsheet with preconditions, steps, expected result and severity for every case. Plus a bug report template, a client sign-off sheet, and:
The eighteen checks worth running before every release. Included in the kit, and free to anyone — take it without buying.
In full, so you can judge the rest. These are the kind that come from handling the incident rather than reading the documentation.
The user suspects compromise and does the one thing everybody knows to do. If it does not kill the attacker's session, that action is ceremonial — and they stop looking, because they believe it is fixed.
This is the control that evicts an attacker, and it fails silently.
A team generalises the error message, declares enumeration fixed, and leaves a 200ms gap — because a real account costs a password hash and a fictional one returns immediately.
The wording check passes. The clock does not.
Sign in, stop at the code prompt, take the interim token straight to a protected endpoint. It cannot be found through the interface, because the interface offers no way to skip.
Found by editing a request, never by clicking.
One download. The playbook, the case bank as a spreadsheet, and the practice sandbox. No subscription, no account.
Buy — $39International · card, PayPal কিনুন — ৳2,400Bangladesh · bKash, Nagad, cardThe live demo runs five of the checks against a simulated system, in your browser. Nothing to install and nothing to sign up for. Watch a defect fire, then switch it off and watch the same check pass.