# Pynt Security Tests Coverage

{% hint style="success" %}
**At a Glance**: 🔐 Pynt offers comprehensive API security testing by leveraging real-world attack simulations and homegrown tests. It addresses key risks highlighted in the **OWASP Top 10** while continuously enhancing its security scope.
{% endhint %}

## Pynt Security Tests Coverage - Introduction

Pynt's security tests cover a wide range of vulnerabilities using **real-world attack simulations** and **homegrown attack scenarios**, ensuring robust API security. These tests align with:

* [**OWASP Top 10 for APIs**](https://owasp.org/www-project-api-security/): Tackling API-specific risks like broken authentication and data exposure.
* [**OWASP Top 10 for Web Applications**](https://owasp.org/www-project-top-ten/): Covering general web vulnerabilities such as injection attacks.
* [**OWASP Top 10 for LLMs**](https://owasp.org/www-project-top-10-for-large-language-model-applications/): Addressing emerging threats in large language models.

Pynt goes beyond the **OWASP Top 10**, offering **homegrown tests** that identify gaps often missed by standard tools. These unique tests bolster your API's security by providing extra protection against potential threats. Learn more at [Pynt vs OWASP: Pynt’s Top-10 Focus](https://www.pynt.io/resources-hub/guides-and-reports/pynt-vs-owasp-pynt-top-10-api-vulnerabilties), for detailed insights.

***

Pynt continuously evolves to provide maximum security coverage. Pynt integrates seamlessly into your CI/CD pipeline, ensuring high accuracy and minimal false positives while safeguarding critical endpoints.

## Pynt Test Cases

{% hint style="info" %}
🛠️ **Note**: This list might be **partial** as it grows rapidly, so stay updated for expanded coverage!
{% endhint %}

<table><thead><tr><th width="397.33333333333326">Test case</th><th>Category</th><th data-hidden></th></tr></thead><tbody><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL001]</strong></a> User data leakage to other users - Resource-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL002]</strong></a> User data leakage to other users - User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL003]</strong></a> User data leakage to other users - Resource-ID and User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL004]</strong></a> User data leakage to other users - credentials authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL005]</strong></a> User data manipulation by other users - Resource-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL006]</strong></a> User data manipulation by other users - User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL007]</strong></a> User data manipulation by other users - Resource-ID and User-ID authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL008]</strong></a> User data manipulation by other users - credentials authorization</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/business-logic-tests"><strong>[BL009]</strong></a> Guessable resource identifier</td><td>Business Logic</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ001]</strong> </a>SQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ002]</strong></a> MS-SQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ003]</strong></a> MySQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ004]</strong> </a>SQLite Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ005]</strong> </a>PostgreSQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ006]</strong></a> NoSQL Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ007]</strong></a> Command Injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/injection-tests"><strong>[INJ008]</strong></a> Server-side template injection</td><td>Injections</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB001]</strong></a> Ignored authentication token</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB002]</strong></a> No signature validation in JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB003]</strong></a> JWT hashed without secret</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB004]</strong> </a>No signature in JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/authentication-bypass-tests"><strong>[AB005]</strong></a> Unsigned JWT</td><td>Authentication bypass</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/mass-assignment-tests"><strong>[MA001]</strong></a> Mass assignment by manipulation of hidden attributes</td><td>Mass Assignment</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/mass-assignment-tests"><strong>[MA002]</strong></a> Mass assignment by flag overloading</td><td>Mass Assignment</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/server-side-request-forgery-tests"><strong>[SSRF001]</strong> </a>Local file access</td><td>Server-Side request forgery</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/stack-trace-in-response"><strong>[ST001]</strong></a> Stack trace in response</td><td>Stack trace in response</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/lack-of-resources-and-rate-limiting"><strong>[RES001]</strong></a> Resources limiting</td><td>Lack of Resources and Rate Limiting</td><td></td></tr><tr><td><a href="pynt-security-tests-coverage/file-path-manipulation"><strong>[FM001]</strong></a> File path manipulation</td><td>File path manipulation</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/graphql-introspection-vulnerability"><strong>[GQL001]</strong></a> GraphQL introspection</td><td>GraphQL introspection Vulnerability</td><td></td></tr><tr><td><strong>[</strong><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/graphql-alias-overloading"><strong>GQL002]</strong></a> GraphQL Alias Overloading</td><td>GraphQL Alias Overloading</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM001]</strong></a> Direct prompt injection</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities">[LLM002]</a> Prompt injection, alignment</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM003]</strong></a> LLM Insecure output handling, type: XSS</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM004]</strong></a> LLM Insecure output handling, type: SSRF</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/llm-apis-vulnerabilities"><strong>[LLM005]</strong></a> LLM Insecure output handling, type:  Markdown</td><td>LLM APIs Vulnerabilities</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/insecure-transport-scheme"><strong>[TLS001]</strong></a> Insecure transport scheme</td><td>Insecure transport scheme</td><td></td></tr><tr><td><a href="https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage/basic-authentication"><strong>[AB006]</strong></a> Basic Authentication</td><td>Basic Authentication</td><td></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.pynt.io/documentation/api-security-testing/pynt-security-tests-coverage.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.