Test-Driven Security
For every vulnerability we find in production, there is a test that, had it existed, would have prevented it. Test-Driven Security treats the CWE list as a checklist and PHPUnit as the tool we already have in our workflow.
From to , I was in Berlin at the International PHP Conference. There I gave the presentations "Test-Driven Security" and "Turbo-Charging Your PHPUnit Suite".
I argue that PHP security flaws result from a lack of testing, and demonstrate how PHPUnit can help prevent common vulnerabilities, such as SQL Injection or Cross-Site Scripting.
More informationTurbo-charge your productivity: discover how to make your test suite blazingly fast!
More informationMy name is Sebastian Bergmann, and I have been working as a software developer and consultant in the PHP ecosystem for over 25 years. I support development teams in creating better software through modern practices, tools and training.
I am deeply committed to Open Source, maintain critical Open Source projects in the PHP ecosystem, and help shape the work of the PHP Foundation as a member of its board. I have also represented the interests of Open Source at the European Commission and am active in the Open Source Working Group ("Arbeitskreis Open Source Software") of the German Informatics Society ("Gesellschaft fΓΌr Informatik").
I live and breathe Open Source and help shape how developers around the world test, write, and maintain their code.
More events where you can meet me are listed here.
My interactive online training courses are designed to provide you with practical knowledge that you can apply immediately. The next ones starting soon are listed here.
For every vulnerability we find in production, there is a test that, had it existed, would have prevented it. Test-Driven Security treats the CWE list as a checklist and PHPUnit as the tool we already have in our workflow.
Slow tests destroy flow, kill TDD, and erode trust until nobody runs the suite. The fix has four tiers, and the biggest wins come from test design, not from infrastructure or parallelisation.
Do you want your team to get better at testing? I can help with consulting, coaching, and training.