3 ms·
This hits a real pain point. I've been on teams with hundreds of endpoints but maybe 10% had any tests beyond "does it return 200?" — and those inevitably rot a
by Mintaras 10mo ago
This hits a real pain point. I've been on teams with hundreds of endpoints but maybe 10% had any tests beyond "does it return 200?" — and those inevitably rot as the API evolves.
Generating tests from a single cURL is smart because it meets devs where they already are. We're already firing off cURL commands during development; turning that into a test suite with zero extra effort is a nice DX win.
A few edge cases I’d love to see:
Rate limit testing (verify proper 429s with Retry-After)
Idempotency checks for POST/PUT endpoints
Unicode edge cases like : emoji, RTL characters, null bytes in strings
The ChatGPT API finding is a great proof point. Nothing sells a security tool better than “we found something in production at a major company.”
Will try this on some internal APIs this week.
- liudasjank 10mo agoThanks for the thoughtful suggestions, those are spot on. Rate-limit testing and proper 429/Retry-After handling are definitely on the roadmap. Idempotency checks for POST/PUT are a great call too, a lot of APIs behave unpredictably there, and it’s one of those areas people rarely test systematically. Unicode/emoji/RTL input fuzzing is a fun one, Rentgen already generates trimming/whitespace/negative cases, but expanding into more string-weirdness categories makes total sense. If you end up trying it on any internal APIs this week, I’d genuinely love to hear what it catches. The tool often surprises me in places I didn’t expect.