{"id":7125,"date":"2026-07-25T14:17:24","date_gmt":"2026-07-25T12:17:24","guid":{"rendered":"https:\/\/www.digitalnisebeobrana.cz\/?p=7125"},"modified":"2026-07-25T14:28:23","modified_gmt":"2026-07-25T12:28:23","slug":"the-application-works-is-that-enough","status":"publish","type":"post","link":"https:\/\/www.digitalnisebeobrana.cz\/en\/the-application-works-is-that-enough\/","title":{"rendered":"The Application Works. Is That Enough?"},"content":{"rendered":"

<\/span>One number<\/span><\/h2>\n

A customer logs in to a new portal and opens their invoice.<\/p>\n

They notice the document number in the page address and try changing it.<\/p>\n

The application displays another customer\u2019s invoice.<\/p>\n

They did not crack a password. They did not bypass the login. They did not use any special tool.<\/p>\n

They changed one number.<\/p>\n

The login still works. Invoices load correctly. The application passed its standard tests.<\/p>\n

The application verified that the user was logged in. It did not verify whether that user was allowed to view this particular document.<\/p>\n

The feature worked.<\/p>\n

Just not securely.<\/p>\n

<\/span>It passed acceptance testing<\/span><\/h2>\n

During application handover, the expected workflow is usually tested.<\/p>\n

A user logs in, completes a form, submits an order or downloads a document. An administrator updates a record. The data is saved and the necessary information is passed to the next system or person.<\/p>\n

This type of testing answers an important question:<\/p>\n

\n

Does the application do what we ordered?<\/p>\n<\/blockquote>\n

It does not automatically answer another one:<\/p>\n

\n

What does the application allow when someone uses it differently from the expected workflow?<\/p>\n<\/blockquote>\n

Can a regular user open someone else\u2019s document? Can they access a function intended for an administrator? Can they see information that does not belong to them? Can they skip part of the process?<\/p>\n

A security issue does not have to cause the application to crash or display an error.<\/p>\n

Quite the opposite. The application may process the request without any problem.<\/p>\n

Just for the wrong user or with someone else\u2019s data.<\/p>\n

\n

Are you accepting or launching a web application?<\/strong><\/p>\n

Send a brief description of the application, its user types and the planned handover date. I will tell you whether it fits the Web Application Security Review<\/a> or needs a Custom Penetration Test<\/a>.<\/p>\n

Send a brief description of the application<\/strong><\/a><\/p>\n<\/blockquote>\n

<\/span>When development speeds up<\/span><\/h2>\n

AI tools can significantly speed up web application development.<\/p>\n

They can help create login flows, administration interfaces, forms, file uploads, exports and integrations with other systems. A working version can appear very quickly.<\/p>\n

That is not a problem by itself.<\/p>\n

The problem starts when development speed is mistaken for verification of the result.<\/p>\n

Every new feature introduces decisions the application must make correctly:<\/p>\n