Last Updated: July 29, 2026 Total Security Tests: 212+ (Unit + Contract + Slop + Secret Scan + Mutation + Cache Integrity + Audit Chain)
Pass Rate: 100%

All security tests follow the no-backdoor policy — tests pass through real security guards, not bypass headers. The slop scanner (bun run slop) and secret misuse scanner (bun run scripts/scan-secret-misuse.ts --strict) run in CI to catch architectural vulnerabilities before they reach production.

Security Enforcement Verification

Every security policy is actively tested, not just documented:

Policy	Enforcement
No test backdoors	Black-box contract tests authenticate via real login
CSPRNG only (no Math.random())	Unit tests verify crypto.getRandomValues()
Setup completion gating	Contract tests: /api/setup/* → 403 after setup
Fail-closed API	Contract tests: unknown namespace → 403 across all 4 DBs
XSS prevention	Slop scanner (bun run slop) + unit/security coverage; run before shipping HTML-heavy UI
Multi-tenant isolation	Contract tests: Tenant-B cannot read Tenant-A data
Account lockout	Unit + edge case: 5 failures → account locked

---

Test Categories

1. Defense-in-Depth — 51 tests ✅

Cookie prefix, setup gating, handler admin verification, media permissions, centralized guards, fail-closed dispatcher.

2. XSS Prevention — 27 tests + property fuzz ✅

Layer	Enforcement
Slop Scanner	Pre-commit gate blocks commits with unsafe {@html}
sanitize-html.ts	16 unit + 11 property fuzz tests (500 random inputs/property)
Mutation Testing	100% effective kill rate — proven no XSS gap
Markdown Widget	parseMD() → sanitizeHtml() verified

All 13 original {@html} vulnerabilities resolved. 0 errors on slop scan.

3. Encryption & Cryptography — 32 tests ✅

AES-256-GCM, Argon2id, SHA-256 audit chaining, HMAC preview tokens.

4. Authentication & Authorization — 77 tests ✅

Account lockout (22 with edge cases), session management (22), fail-closed API v2.0 (45).

5. Endpoint Security Audit — 6 categories ✅

Automated penetration testing against live endpoints. Probes for auth bypass, XSS reflection, SQLi injection, path traversal, missing security headers, and rate limiting gaps.

bun run security                 # audit running server
bun run security --ci            # CI mode (fail on critical/high)
bun run security --base=http://.. # custom URL

Requires a running server (preview or dev mode). Run in a separate terminal:

node build/index.js   # or: bun run dev

Audit categories with real payloads:

Category	Payloads	Risk If Found
Auth bypass	4 protected endpoints unauthenticated	CRITICAL
XSS reflection	<script>, <img onerror>, javascript:	HIGH
SQLi injection	DROP TABLE, OR 1=1, UNION SELECT	HIGH
Path traversal	../../etc/passwd, ..\system32	CRITICAL
Security headers	CSP, HSTS, X-Frame-Options, X-Content-Type	HIGH/MEDIUM
Rate limiting	15 rapid login attempts	HIGH

6. Secret Misuse Scanner — 6 rules ✅

Static analysis that detects hardcoded credentials in source code. Runs in CI with --strict flag.

bun run scripts/scan-secret-misuse.ts          # scan all files
bun run scripts/scan-secret-misuse.ts --strict # CI mode (exit 1 on findings)

Rule	Detection
1	Private keys accessed in non-server files
2	console.log with DB_PASSWORD, JWT_SECRET, ENCRYPTION_KEY
3	Known API key patterns (AWS, GitHub, Stripe, JWT, Slack)
4	SVELTYCMS_TEST_SECRET_2026 outside benchmark allowlist
5	High-entropy string assignments (generic secret detection)
6	Hardcoded credentials in comparisons — catches backdoors like password === "secret"

7. Security Architecture Scanner — 5 rules ✅

Part of the slop scanner (bun run slop). Detects insecure architectural patterns that regex-based secret scanners miss.

bun run slop                   # scan all files
bun run slop --strict          # CI mode (fail on findings)

Rule	Detection
CORS reflection	Access-Control-Allow-Origin reflecting arbitrary Origin header
Broad MIME types	File upload allowlist accepting application/* without subtypes
Fast hash for secrets	createHash("sha256") used on API keys/tokens instead of HMAC
Introspection bypass	GraphQL introspection gated on BENCHMARK_MODE env flag in production
System user backdoor	user._id === "system" && password === "hardcoded" patterns

---

Running Security Tests

bun run test:unit -- security     # Encryption, auth, lockout
bun run slop --strict              # XSS, RTL, button variants + 5 security architecture rules
bun run test:security              # Hooks defense-in-depth / auth / RBAC / file-server
bun run scripts/scan-secret-misuse.ts --strict  # 6-rule hardcoded secret detection
bun run security                   # Endpoint probing (needs running server)
bun run test:smart                 # Smart orchestrator

Category	Tests	Pass Rate	Enforcement
Encryption & Crypto	32	100%	Unit tests
XSS Prevention	27 + property fuzz	100%	Pre-commit slop + mutation
Account Lockout	22	100%	Unit + edge cases
Fail-Closed API 2.0	45	100%	Contract tests (4 DBs)
Defense-in-Depth	51	100%	Unit tests
Endpoint Audit	6 categories	Active	bun run security
Session Persistence	22	100%	Unit tests
Secret Misuse Scan	6 rules	Active	bun run scripts/scan-secret-misuse.ts --strict
Security Architecture Scan	5 rules	Active	bun run slop --strict
Cache Integrity	6	100%	HMAC signing, tamper detection
Audit Chain Verification	7	100%	SHA-256 chaining, replay detection
Total Security	212+	100%	4-gate pre-commit + CI

Related Documentation

• Security Overview
• Testing Strategy