Quality

Automates testing of APIs for Broken Function Level Authorization (BFLA) vulnerabilities, checking whether non-admin users can access administrative functions. Use during security assessments to identify privilege escalation risks.

Tests APIs for excessive data exposure, identifying sensitive data leaks in responses such as PII, credentials, and internal details. Used in authorized security assessments to ensure APIs return only necessary data.

Exploits JWT algorithm confusion vulnerabilities by forcing a server to verify a token signed with a symmetric algorithm using the public key, enabling authentication bypass. For authorized security testing of APIs using RS256 JWTs.

Enforce API input/output contracts using OpenAPI and JSON Schema to prevent injection attacks, block mass assignment, prevent data leakage, and ensure type safety across all API interactions.

Implements comprehensive API security testing via static audit of OpenAPI definitions and dynamic conformance scanning. Detects OWASP API Security Top 10 vulnerabilities and integrates into CI/CD pipelines.

Automatically generate and execute stateful fuzzing test sequences against REST APIs to discover security bugs like unhandled exceptions and input validation flaws. Ideal for CI/CD security regression testing.

Uses Postman to build automated API security test collections covering the OWASP API Security Top 10. Ideal for CI/CD integration via Newman, multi-role authorization testing, and combined manual/automated testing with OWASP ZAP.

A systematic workflow for implementing new features, from codebase exploration and requirements clarification to architecture design, implementation, and quality review.

Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Automatically improves recently modified code based on project standards.

Reviews frontend code (TSX, TS, JS) for code quality, performance, and business logic issues using a predefined checklist. Supports reviewing staged changes or specific files before commit.

Generates Vitest + React Testing Library tests for Dify frontend components, hooks, and utilities. Use when writing, reviewing, or improving frontend test coverage.

Guides users through migrating a JavaScript/TypeScript project from ESLint to Oxlint using the @oxlint/migrate tool. Covers automated migration, config review, and handling unsupported features.