Security

Yes4

• Is fuzz testing worth it?Yes

  Yes, fuzz testing is worth it for code that parses input from outside, such as uploaded files or webhook bodies: write one fuzz target per parser, run it for a short time in CI, and keep every crashing input as a regression test; do not run it for hours on every pull request.

• Is penetration testing worth it?Yes

  Yes, penetration testing is worth it for an application that holds customer accounts or personal data: book an outside tester once a year and after changes to login, roles or file handling, and fix and retest every finding.

• Should I test rate limits?Yes

  Yes, give each group of rate-limited routes one integration test that lowers the limit in the test configuration, sends one request over it and expects a 429; do not test the counting algorithm of the rate-limiting library.

• Should I test two-factor authentication?Yes

  Test two-factor authentication before it ships: every route that creates a session must keep a user with 2FA on signed out until a valid code arrives, a used code must fail, and failed codes must hit an attempt limit; do not test the TOTP algorithm inside the library.