skills.rest
nguyenpv1980-wq
nguyenpv1980-wqCOMMUNITY
Explore all skills by this author →
GitHub

multi-tenant-security-tester

Design negative-test suites proving tenant isolation and object-level authorization denial.

2|Updated Jul 6, 2026
Search Tags:#authorization#regression tests#tenant isolation#idor#multi-tenant security#negative testing
One-click install
npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill multi-tenant-security-tester
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: multi-tenant-security-tester
Source: https://github.com/nguyenpv1980-wq/Project-Aegis/tree/main/.claude/skills/multi-tenant-security-tester
Command: npx skills add https://github.com/nguyenpv1980-wq/Project-Aegis --skill multi-tenant-security-tester

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill turns tenant-isolation and authorization concerns into executable proof by designing tests that only pass when forbidden cross-tenant or cross-privilege actions are denied. It helps teams verify that security boundaries hold across APIs, search, exports, jobs, and other shared surfaces instead of assuming isolation from happy-path behavior.

Core Features & Use Cases

  • Two-tenant fixture design: Seeds Tenant A and Tenant B with representative users, roles, and resource IDs so each side can attempt the other's data.
  • Negative test matrix: Builds surface × actor × operation coverage for IDOR, list leakage, mass-assignment, search, AI retrieval, exports, background jobs, and support tooling.
  • Leakage assertions: Checks denial semantics, error-body leaks, header leaks, and 404-versus-403 consistency to catch subtle exposure paths.
  • Regression-ready output: Converts incident findings or threat-model abuse cases into permanent security test specifications with honest coverage statements.
  • Use Case: Use this Skill when preparing a security-sensitive launch and you need a cross-tenant regression suite that proves unauthorized access is blocked everywhere it matters.

Quick Start

Ask the skill to design a two-tenant negative test suite that proves Tenant A cannot access Tenant B’s resources through the API, search, exports, and background jobs.

Frequently Asked Questions about multi-tenant-security-tester

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write negative tests to prove tenant isolation in a multi-tenant API?▼

To prove tenant isolation, write negative tests that seed two separate tenants and assert forbidden cross-tenant API actions are explicitly denied. This verifies unauthorized object-level access is blocked at the authorization layer.

What is a negative test matrix for cross-tenant data leakage?▼

A negative test matrix for cross-tenant data leakage systematically validates denial across shared surfaces like APIs, search, and exports. It maps surface, actor, and operation coverage to catch list leakage and mass-assignment vulnerabilities.

How do I test for IDOR and mass-assignment vulnerabilities in multi-tenant applications?▼

Test for IDOR and mass-assignment vulnerabilities by minting real auth-path tokens for Tenant A and attempting operations against Tenant B's resources. Denial semantics and 404-versus-403 consistency prevent subtle exposure paths and error-body leaks.

Does my security test suite need two-tenant seeded fixtures to check tenant isolation?▼

Yes, checking tenant isolation requires two-tenant seeded fixtures with representative users, roles, and resource IDs. This setup ensures each side can genuinely attempt the other's data through real authentication paths to verify boundaries hold.

What's the best way to convert threat model abuse cases into regression tests?▼

The best way to convert threat model abuse cases into regression tests is to design executable negative-test specifications with explicit leakage assertions. This creates permanent security tests with honest coverage statements for ongoing verification.

Why do my API security tests pass but cross-tenant search and export leakage still occurs?▼

API security tests often miss cross-tenant search and export leakage because they only validate happy-path behavior. Negative testing checks denial semantics across all shared surfaces, including background jobs and AI retrieval, to catch subtle exposure paths.

Related Skills

Explore More Software Engineering Skills→
adbertramadbertram

prowler-test-api

Provide structured testing patterns and fixtures for Prowler API validation.

Community
Advanced
POWERFULMOVESPOWERFULMOVES
1

qa-regression

Automate end-to-end regression testing for web applications with Playwright.

Community
Advanced
inbharataiinbharatai
22

threat-modeler

Perform STRIDE analysis and generate attack trees for software systems.

Community
Advanced
machenjiemachenjie
4

permission-boundary-modeling

Model authorization as subject-resource-action-condition rules with auditable backend enforcement.

Community
Advanced