# Pynt Security Tests Coverage

{% hint style="success" %}
**At a Glance**: 🔐 Pynt offers comprehensive API security testing by leveraging real-world attack simulations and homegrown tests. It addresses key risks highlighted in the **OWASP Top 10** while continuously enhancing its security scope.
{% endhint %}

## Pynt Security Tests Coverage - Introduction

Pynt's security tests cover a wide range of vulnerabilities using **real-world attack simulations** and **homegrown attack scenarios**, ensuring robust API security. These tests align with:

* [**OWASP Top 10 for APIs**](https://owasp.org/www-project-api-security/): Tackling API-specific risks like broken authentication and data exposure.
* [**OWASP Top 10 for Web Applications**](https://owasp.org/www-project-top-ten/): Covering general web vulnerabilities such as injection attacks.
* [**OWASP Top 10 for LLMs**](https://owasp.org/www-project-top-10-for-large-language-model-applications/): Addressing emerging threats in large language models.

Pynt goes beyond the **OWASP Top 10**, offering **homegrown tests** that identify gaps often missed by standard tools. These unique tests bolster your API's security by providing extra protection against potential threats. Learn more at [Pynt vs OWASP: Pynt’s Top-10 Focus](https://www.pynt.io/resources-hub/guides-and-reports/pynt-vs-owasp-pynt-top-10-api-vulnerabilties), for detailed insights.

***

Pynt continuously evolves to provide maximum security coverage. Pynt integrates seamlessly into your CI/CD pipeline, ensuring high accuracy and minimal false positives while safeguarding critical endpoints.

## Pynt Test Cases

{% hint style="info" %}
🛠️ **Note**: This list might be **partial** as it grows rapidly, so stay updated for expanded coverage!
{% endhint %}

<table><thead><tr><th width="397.33333333333326">Test case</th><th>Category</th><th data-hidden></th></tr></thead><tbody><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL001]</strong></a> User data leakage to other users - Resource-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL002]</strong></a> User data leakage to other users - User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL003]</strong></a> User data leakage to other users - Resource-ID and User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL004]</strong></a> User data leakage to other users - credentials authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL005]</strong></a> User data manipulation by other users - Resource-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL006]</strong></a> User data manipulation by other users - User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL007]</strong></a> User data manipulation by other users - Resource-ID and User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL008]</strong></a> User data manipulation by other users - credentials authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL009]</strong></a> Guessable resource identifier</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ001]</strong> </a>SQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ002]</strong></a> MS-SQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ003]</strong></a> MySQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ004]</strong> </a>SQLite Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ005]</strong> </a>PostgreSQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ006]</strong></a> NoSQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ007]</strong></a> Command Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ008]</strong></a> Server-side template injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB001]</strong></a> Ignored authentication token</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB002]</strong></a> No signature validation in JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB003]</strong></a> JWT hashed without secret</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB004]</strong> </a>No signature in JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB005]</strong></a> Unsigned JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/mass-assignment-tests"><strong>[MA001]</strong></a> Mass assignment by manipulation of hidden attributes</td><td>Mass Assignment</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/mass-assignment-tests"><strong>[MA002]</strong></a> Mass assignment by flag overloading</td><td>Mass Assignment</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/server-side-request-forgery-tests"><strong>[SSRF001]</strong> </a>Local file access</td><td>Server-Side request forgery</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/stack-trace-in-response"><strong>[ST001]</strong></a> Stack trace in response</td><td>Stack trace in response</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/lack-of-resources-and-rate-limiting"><strong>[RES001]</strong></a> Resources limiting</td><td>Lack of Resources and Rate Limiting</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/file-path-manipulation"><strong>[FM001]</strong></a> File path manipulation</td><td>File path manipulation</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/graphql-introspection-vulnerability"><strong>[GQL001]</strong></a> GraphQL introspection</td><td>GraphQL introspection Vulnerability</td><td></td></tr><tr><td><strong>[</strong><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/graphql-alias-overloading"><strong>GQL002]</strong></a> GraphQL Alias Overloading</td><td>GraphQL Alias Overloading</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM001]</strong></a> Direct prompt injection</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities">[LLM002]</a> Prompt injection, alignment</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM003]</strong></a> LLM Insecure output handling, type: XSS</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM004]</strong></a> LLM Insecure output handling, type: SSRF</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM005]</strong></a> LLM Insecure output handling, type:  Markdown</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/insecure-transport-scheme"><strong>[TLS001]</strong></a> Insecure transport scheme</td><td>Insecure transport scheme</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/basic-authentication"><strong>[AB006]</strong></a> Basic Authentication</td><td>Basic Authentication</td><td></td></tr></tbody></table>