I've fuzzed a small part of the GitHub API (2020)

I think the real conclusion here is... No substantial security issues were discovered. There are a few things github could change to better follow security best practices to help avoid future bugs.

Ah yes, ISO 8061, Alpine ski-bindings — Selection of release torques values.<p><a href="https:&#x2F;&#x2F;www.iso.org&#x2F;standard&#x2F;75609.html" rel="nofollow">https:&#x2F;&#x2F;www.iso.org&#x2F;standard&#x2F;75609.html</a><p>Nice article btw.

Doing this sort of thing to a live webservice is a good way to get a perma-ban...

The cats tool looks interesting I&#x27;m curious how it handles fuzzing id columns, which would need a reference to another resource to actually test them. I would like a tool which can take insertion order of the api and start inserting things at random based on a spec to test it.

&gt; The InvalidValuesInEnumsFieldsFuzzer will send invalid values in enum fields. It expects a validation error in return. The GitHub API does not seem to reject invalid values, but rather convert them to a default value and respond successfully to the request. This is in contradiction with the OWASP recommendation around strong input validation and data type enforcing.<p>Doing this is incredibly good practice for compatibility, because otherwise you can never add or remove enum values because older clients will break on the unknown values. I also fail to see how it violates the recommendation, invalid data doesn&#x27;t enter the system.<p>Imagine all webservers and browsers would need to be updated for every new HTTP header or status code is specified or web pages don&#x27;t work anymore...

GitHub performs fuzzing as part of their testing, so I&#x27;m not surprised there aren&#x27;t any significant findings. I <i>am</i> surprised this is on hackernews two years later though.

Would any of these errors be present if they used GraphQL instead of REST? Obviously the ones with headers can still happen, but it looks like everything else is related to schema enforcement

the results of the fuzzing is overall very meh, but CATS looks like an interesting tool.