top of page
Week 3: Testing the Challenge Detection Layer
Most test suites verify that a system does the right thing when inputs are normal. FinBot adds a harder requirement: verify that the system notices when something wrong is happening, even when the wrong thing looks normal on the surface. That is what the CTF detector layer does. And testing it requires a different way of thinking. What Detectors Do Every event that flows through Redis Streams gets evaluated against a set of detectors. Each detector answers one question: did t
carocsteads
Mar 273 min read
Week 2: How I Approach Testing AI Systems (And Why It's Different)
How I Approach Testing AI Systems (And Why It's Different) Most testing advice assumes you control what your code returns. With AI systems, you don't. The model decides. That changes everything about how you write tests. Here's the approach I use when testing LLM integration layers — the classes that sit between your application and the AI provider. The One Rule: Mock the Service, Never Your Code When I test an AI client, I mock the network call to OpenAI or Ollama — not the
carocsteads
Mar 274 min read
Automating Privileged Access Management:
A QA Engineer's Journey with Apache Guacamole By Carolina Steadham | QA Automation Engineer Introduction In today's cybersecurity landscape, privileged access management (PAM) is critical for protecting sensitive systems. I recently completed a comprehensive QA automation project focused on testing Apache Guacamole, a clientless remote desktop gateway that provides secure access to RDP, VNC, SSH, and Telnet connections through a web browser. This project showcases my experti
carocsteads
Dec 15, 20253 min read


PortSwigger Exploiting APIs
1. Objective 2. Lab: Exploiting an API endpoint using documentation 3. Lab: Finding and exploiting an unused API endpoint 4. Lab: Exploiting a mass assignment vulnerability 5. Lab: Exploiting server-side parameter pollution in a query string 1. Objective: This document showcases a set of hands-on API security testing exercises completed through the PortSwigger Web Security Academy. The goal is to demonstrate practical skills in identifying, analyzing, exploiting and mitiga
carocsteads
Jul 29, 20257 min read
bottom of page