Security Testing Complete Guide 2026 — Web, API & Mobile for QA Engineers
The 2026 security testing guide for QA engineers — OWASP Top 10, API Security Top 10, DAST vs SAST, ZAP & Burp basics, authentication & authorization tests, and a shift-left workflow.
Last updated 2026-07-20 · 16 min read · By Avinash K
QA engineers are increasingly asked to own the first line of security testing. This guide covers what you should test yourself, what to escalate, and the tools that make you productive without a pentester's background.
1. OWASP Top 10 (2021, still canonical in 2026)
- Broken Access Control
- Cryptographic Failures
- Injection
- Insecure Design
- Security Misconfiguration
- Vulnerable and Outdated Components
- Identification and Authentication Failures
- Software and Data Integrity Failures
- Security Logging and Monitoring Failures
- Server-Side Request Forgery
The full OWASP Top 10 project has attack examples and preventions for each. Read once, revisit annually.
2. OWASP API Security Top 10
Broken Object Level Authorization (BOLA) is the #1 API vulnerability of the decade. Test: "can user A read/modify user B's data by changing an ID in the URL?" If the answer is yes anywhere, escalate immediately.
3. DAST vs SAST vs IAST vs SCA
- SAST — static analysis of source code (Semgrep, SonarQube).
- DAST — dynamic analysis of a running app (ZAP, Burp).
- IAST — instrumentation inside the running app (Contrast).
- SCA — dependency vulnerability scanning (Snyk, Dependabot).
QA usually owns DAST and helps interpret SCA. SAST is typically a security-team tool.
4. OWASP ZAP — the free tool every QA should know
Point ZAP at a staging URL, run the automated scan, review alerts. Wire the CLI in CI for a smoke security scan on every deploy. ZAP catches XSS, injection basics, and misconfigurations — not sophisticated logic flaws.
5. Authentication and authorization tests every app needs
- Login with wrong password — proper rate limiting, no user-enumeration message.
- Session expiry — enforced server-side, not just client-side.
- Password reset — token single-use, expires quickly, invalidates other sessions.
- Role escalation — user role cannot access admin endpoints even with a hand-crafted request.
- Multi-tenant isolation — tenant A cannot read tenant B's data by any means.
6. Shift-left workflow
- SCA on every PR — block on critical CVEs.
- SAST on every PR — non-blocking for the first quarter, then blocking on high severity.
- DAST smoke on every deploy to staging.
- Full DAST + manual review pre-release.
- Pentest annually or on major architectural changes.