Think about your own work or business in this area: the product writes tests describing secure behavior and proves your code fails them. What is the single biggest problem you have there right now? Be specific about what it costs you (time, money, customers) and what you have already tried.

Marty Mitchellnegative

The biggest problem is the sheer manual overhead. We're running OWASP ZAP, which is great, but then we have a spreadsheet where we track findings across our Node and Go services. Someone has to manually verify each one, write up proof steps, and ensure they're added to CI. This consumes probably 5-8 hours a week of engineer time that could be spent on feature development or optimizing our core product. It's not just time; it's also the risk of human error – missing a finding or misinterpreting a result. We’ve tried to streamline it by creating templates for proof steps, but it’s still a bottleneck and doesn't give us the confidence we’d ideally want.

Violet Ryannegative

The biggest problem is the overhead of maintaining those tests. While I believe in writing regression tests for critical auth and input validation, it's a significant time investment. Each test needs careful crafting and ongoing updates as services evolve. This takes away from other architectural work or deeper security analysis. We've tried to automate test generation, but it often produces brittle tests that fail for reasons other than genuine security issues, leading to false positives that still require manual triage. It costs us developer time that could be spent on proactive security measures, and occasionally, a missed edge case can slip through.

Lennox Balnuweitneutral

Right now, the biggest problem is that we're still manually reproducing findings in staging and documenting guardrails. It costs me at least 2-3 hours per finding—time I could be spending on automating the pipeline. We’ve tried assigning guardrail tests, but they’re often brittle or ignored. The real cost? Those flaws creep back in. My spreadsheet system works, but it’s not scalable. I need a way to auto-generate reproducible tests from findings and tie them to CI without adding overhead. My spreadsheets are transparent, but they’re also a bottleneck. I’d love a tool that turns 'this was an SQLi' into a framework-agnostic regression test, but I’m skeptical of anything that promises magic.

Charumati Buttnegative

The biggest problem right now is the sheer time it takes to write and maintain these specific tests. We have a six-person team, and I'm the API owner for these critical paths. Every time a change is made, we have to manually verify it, which drains developer hours. We've tried standardizing our Postman collections, but it's still a lot of manual checking and updating our Google Sheet. This delay directly impacts our deployment speed, costing us potentially days of productivity per release cycle. I'm always looking for ways to automate this verification.

Moïse Rousseauneutral

The idea of automatically testing secure behavior is appealing, especially given my current frustrations. The biggest problem we face is the sheer overhead. Our existing security platform flags issues, but then my team and I spend significant time manually triaging and verifying these in Linear. It duplicates effort and causes friction with the developers who feel we're adding unnecessary steps. This process costs us valuable engineering hours each week – time that could be spent on development rather than on this manual consolidation and re-testing. We've tried better documentation and clearer guidelines, but the manual oversight is still there because I don't fully trust the current platform covers everything.

Simulated interest: 70/100

Bernadette Wuckertnegative

The biggest problem is ensuring the tests accurately reflect *all* potential attack vectors, especially obscure ones. We're spending too much time manually verifying exceptions from our free scanners, which are often noisy. I recently blocked a release over a CVE missed by automation. This costs us developer velocity and frankly, creates friction when I have to push back on timelines. We've tried refining scanner configurations, but it's a constant game of whack-a-mole.

Daryl Bahringernegative

Right, so, the biggest problem with that idea is the sheer time it would take. I'm already juggling multiple client stacks, each with its own quirks and security needs. Trying to write specific tests for secure behaviour for *all* of them, and then proving they fail? That’s a massive overhead. We're talking potentially days per client, which is time I’d normally be billing or spending on manual reviews. My current process, using scanners and my Notion checklist, is already stretched thin. I’ve tried to automate where I can, but it’s hard with such varied tech. It’s not about the money directly; it’s about the bandwidth. I can’t afford to spend that much extra time on one aspect when clients have other pressing needs.

Deepali Ahujaneutral

The idea of having the product write tests for secure behavior is interesting. My biggest problem right now is the sheer volume of alerts from our existing scanning tools. It’s overwhelming, and frankly, I worry about missing critical issues due to fatigue. Manually sifting through findings and then tracking remediation across three services and two mobile backends takes up a significant chunk of my week – easily an extra 10-15 hours weekly. We’ve tried setting up better alerting rules, but it’s still a constant battle to stay on top of everything without a more integrated approach.

Simulated interest: 30/100

Mathijs van Veenneutral

The biggest problem is the sheer time it consumes. Manually reproducing potential vulnerabilities in staging, on top of writing and reviewing code, stretches us thin. It costs me hours each week, potentially delaying feature releases and leaving less time for proactive security work. We already use open-source scanners and PR checklists, but they don't catch everything. I'd need to understand how this system integrates and if it genuinely reduces the manual effort without introducing new complexities or dependencies we can't manage.

Isabel Bashiriannegative

The biggest problem is the sheer manual overhead. We're spending hours each week tracking findings from our free CI scanners in Jira and a spreadsheet. Two senior devs rotate this, taking time away from their core work. The cost? It's primarily developer time and the risk of human error, especially when fixes touch critical areas like checkout. We've tried rigorous code review processes, but it's still a manual gate. I need a way to codify these security behaviors into automated tests that reliably prove fixes are effective, not just a checklist item.