The Security Test Agent in Qodex helps you proactively catch vulnerabilities like broken access control, token misuse, and OWASP Top 10 risks without needing to write complex security tests manually. It works alongside your functional testing to validate security rules across endpoints and environments.

​
What It Does

  • Scans your API flows for common security pitfalls
  • Auto-generates test scenarios based on OWASP Top 10
  • Injects edge-case payloads to simulate malicious behavior
  • Checks role-based access violations across endpoints
  • Surfaces real security gaps with detailed failure logs

​
Key Tests Included

  • Broken access control Attempts unauthorized access using standard and manipulated tokens
  • Token abuse checks Tests expired, missing, or malformed tokens
  • Rate limiting tests Simulates burst calls to check if limits are enforced
  • Sensitive data exposure Looks for unsecured PII fields or unencrypted responses
  • Custom security rules Define your own assertions for roles, headers, or response structure

​
How to Use It

  1. Create a test scenario using the AI Agent e.g., “Check if user without admin role can access /admin endpoints”
  2. Qodex suggests security-focused test rules Includes both status checks (403/401) and field-level validations
  3. Run the test Failures will show up in the Build tab with specific logs and auto-heal suggestions
  4. Monitor security posture Track failures, fix issues, and re-run updated tests