Glossary
Fuzzing
Fuzzing generates large volumes of malformed, boundary-case, or randomized input and feeds it to a system automatically, watching for crashes, errors, or behavior that deviates from what's expected — including, for an authorization system, cases where a malformed request is granted access it should have been denied. Unlike a manually written test, a fuzzer explores input space a human tester is unlikely to think to try.
Fuzzing an authorization boundary specifically means generating malformed tokens, out-of-range identifiers, and unexpected field combinations, then confirming the system fails closed on all of them rather than a hand-picked few. It complements rather than replaces manual adversarial review, which is better at reasoning about a specific, targeted attack path.