CRASHTEST

Summary from the TLDR InfoSec newsletter

Crashtest runs adversarial security tests against a JavaScript app's real route handlers entirely in-process, so it never opens a socket or needs a live server. Its built-in campaigns cover identity-spoofing headers, prototype pollution, cross-tenant ID enumeration, leaked secrets, and cost-amplification abuse, and every attack ends in a verdict of REFUSED, EXPLOITED, or BOUNDED (an accepted risk with a named owner). It plugs into Hono, Express, and Fastify, and its GitHub Action fails CI only on a new exploit or a regression, never on risks the team already accepted.