Green CI on Friday. Production breach on Monday. The gap is almost always missing negative cases: unauthenticated calls, malformed tokens, injection strings in query params, headers absent on the root response.
A security test generator does not close the gap alone. You still wire real routes, swap placeholder paths, run the suite against a staging host. What you get here is a structured scaffold so your team does not start from a blank describe() block every sprint.
Generated files use generic paths like /login and /protected-endpoint. They assert status codes against those placeholders. No spider, no authenticated crawl, no business-logic abuse. Treat output as a checklist skeleton, not an OWASP ASVS sign-off or a substitute for a professional penetration test.
Six categories, what each block tries to prove
Checkboxes map to describe blocks or Postman folders. Uncheck a row when your stack already covers the area elsewhere.
- Authentication & Authorization
- 401 without credentials, 401 with garbage tokens, 403 when a low-privilege token hits an admin route, weak password rejection on register.
- Injection
- SQL strings in login bodies, XSS in comment fields, shell metacharacters in execute-style endpoints. Payloads are textbook samples, not a full fuzz list.
- Data validation
- 10k-character names, invalid email shapes, executable filenames on upload fields.
- Session management
- Token invalidation after logout, expired session rejection. Timeout tests need your clock or mock setup.
- Cryptographic checks
- Password fields absent from JSON responses, HTTPS base URL expectation, token length uniqueness in a small batch.
- HTTP headers
- Presence of X-Frame-Options, nosniff, HSTS, CSP on the root GET. Server version strings hidden where possible.
Five export shapes
| Framework | File you get | Runs where | Gap to fill |
|---|---|---|---|
| Laravel | tests/Feature/SecurityTest.php | php artisan test against your app | Set APP_URL to your target host, replace route paths, wire Sanctum or Passport tokens in auth tests |
| Jest | security-tests.test.js | Node CI with axios installed | Replace paths, add auth helper in beforeAll |
| Pytest | security-tests.test.py | Python pipeline with requests | Map class methods to your route table |
| Postman | Collection JSON | Newman or desktop runner | Auth folder only ships two requests today. Session and crypto folders are Laravel/Jest/Pytest only. |
| OWASP ZAP | Node driver script | Machine with ZAP proxy on 8080 | Install ZAP, configure target scope, never point at prod without approval |
Application type (web, API, SPA, mobile backend) labels the suite in comments. Output structure stays the same. Rename endpoints yourself.
Why placeholder routes break naive CI jobs
Out of the box, Jest posts to /login with ' OR '1'='1. Your API might use /auth/token with OAuth fields. The test fails with 404, not 400. Developers mark the job flaky and disable the folder.
Fix order: copy the file, global-replace the base URL if needed, then replace each path segment. Run one describe block against staging before you merge the whole tree. One green auth test beats six red injection tests you never read.
Where this sits beside other generators
The API Test Generator builds happy-path REST coverage with status and schema checks. Start there when endpoints lack basic automation.
Layer this page when you need negative security cases on the same routes. The Integration Test Generator covers multi-service flows. Security blocks fit inside those suites after you paste auth helpers from here.
Static source review belongs on the Code Security Scanner or Code Vulnerability Scanner pages. Runtime header checks from this tool complement static findings, not replace them.
Manual probe before codegen? Send one request through the API Endpoint Tester, confirm the path responds, then paste the URL into the target field above.
Download names and copy behavior
Copy puts the editor buffer on the clipboard. Download names the file by framework: SecurityTest.php for Laravel, .test.js, .test.py, .json, or .js for ZAP driver code. No zip, no env file, no GitHub Action YAML.
For full browser regression with login flows, open the End-to-End Test Generator. For unit-level mocks without HTTP, the Unit Test Generator stays closer to function scope.
Reviewed August 2026. Generation runs in your browser. Target URLs are not sent to Toolexe servers.
