<objective A login test that only checks the happy path passes while an expired JWT still grants admin, an IDOR lets user A read user B's orders, and a webhook field reaches . This skill forces the negative-path checks — broken access control, injection, SSRF, auth bypass, supply-chain drift — into CI on every PR, layered across DAST, SCA, SAST, and custom Playwright tests so no single tool's blind spot ships. It produces runnable tests mapped to the OWASP Top 10 (2025) plus the CI gates that fail the build when a category regresses. </objective Discovery Questions Check first — if it exists,…