Testing Methodology

Can an attacker evade detection? We test obfuscation, encoding tricks, and novel attack patterns that attempt to bypass the scanner.

• -Multi-layer obfuscation and encoding bypass attempts
• -Novel exfiltration channels not covered by existing patterns
• -Context-dependent payloads that change behavior based on parser
• -Time-delayed activation designed to evade initial scans

Does the scanner work on unknown targets? We test against real-world MCP servers and deployed applications to measure accuracy at scale.

• -Scan public MCP servers from community registries
• -Validate findings against manually audited ground truth
• -Measure detection rate vs. false positive rate at scale
• -Cross-reference with other security tools for coverage gaps

Does fixing one thing break another? Every confirmed vulnerability becomes a permanent test case. The corpus only grows.

• -Confirmed findings become permanent regression test cases
• -Pattern changes must pass the full regression suite before merge
• -Historical findings re-tested against every scanner release
• -Corpus includes both true positives and confirmed false positives

Does the scanner catch what it claims to catch? We maintain deliberately misconfigured targets that trigger every detection rule, alongside secure baselines that must produce zero findings.

• -Purpose-built vulnerable targets covering all BaaS detection categories
• -Secure baseline projects validated for zero false positives
• -Both Supabase and Firebase configurations tested end-to-end
• -Tests run against deployed cloud infrastructure, not mocks

Does the detection logic work in isolation? Every pattern, parser, and scanner module has dedicated unit tests covering both positive and negative cases.

• -Comprehensive coverage across pattern matching, probe logic, and bundle analysis
• -Per-module test isolation with mocked API responses
• -All tests run in CI on every commit — zero flaky tests policy