A test that still passes for the wrong user guards nothing

A passing test proves less than it looks

A test that sends a request and gets a 200 back tells you the feature works for that user. It says nothing about whether the check that protects it exists. Delete the permission check, and the test still passes.

So every test runs twice

featkpr writes each test from the map of a product, per route and per role. Then, for every test that has a user without permission to do the thing, it sends the same request again as that user. The second run must be refused. If it passes too, the first pass guarded nothing.

What happened on BookStack

So far featkpr has written 481 tests from BookStack’s code. In the run of 26 Sep 2026, 17:42 UTC, 304 ran and all passed. 269 of them were refused to the wrong user, as they should be. 35 are unchecked: BookStack has no user without that permission to try them as yet.

Why this matters for your app

Broken access control is first in OWASP’s 2025 list of web risks. The usual guard is a person remembering to write the negative test. Running every test as the wrong user makes that negative test a rule, and the count tells you how much of your app it covers.

The full numbers, step by step, are in the BookStack report.