\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Bruna Santos is a QA Lead at Devoteam Portugal, with over 13 years of experience in software testing across sectors such as cybersecurity, banking, finance, and telecommunications.<\/p>

She specialises in the intersection of quality and security, with hands-on experience in OWASP, Burp Suite, API testing, and test automation. Prior to joining Devoteam, she led the Quality team at AnubisNetworks, a cybersecurity company, where she developed security testing and applied automation practices.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t

\n\t\t\t\t\t\t

\n\t\t\t\t

\n\t\t\t\t\t\t\t

\n\t\t\t

<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t

\n\t\t\t\t\t

CALENDAR<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Call for Speakers<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
27 October<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
OWASP API Security Top 10 in Practice: From Manual Penetration Testing to the QA Pipeline<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Most QA teams test API functionality thoroughly but treat security as a separate, manual, and late-stage activity \u2014 when they test it at all. The result is predictable: critical vulnerabilities are only discovered during occasional audits, far removed from the development cycle where they would be cheaper to fix.<\/p>
This presentation explores how to integrate the OWASP API Security Top 10 into the regular testing cycle, turning risks such as Broken Object Level Authorization (BOLA), broken authentication, and excessive data exposure into automated, repeatable checks. Drawing on real-world cases, we will explore the most critical risks in the Top 10, with concrete examples of exploitation and, more importantly, detection. We will demonstrate how tools QA professionals already know \u2014 Postman and automation frameworks such as Playwright \u2014 can address a significant proportion of these risks without requiring a dedicated security specialist or additional budget.<\/p>
The central theme is mapping each OWASP item to the exact point in the pipeline where it should be tested: what functional tests can validate, what requires a dedicated security test, and what can \u2014 and should \u2014 run automatically with every build.\n\nThe goal is practical: to equip API testers with a set of techniques they can start applying the following Monday, demonstrating that security testing is not a separate discipline, but a natural extension of QA work.\n\nAttendees will leave the session with a clear, actionable roadmap \u2014 not just an abstract list of threats.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Calendar<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Call for Speakers<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
27 October<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
OWASP API Security Top 10
na Pr\u00e1tica: Do Pentest Manual ao Pipeline de QA<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Most QA teams test API functionality thoroughly but treat security as a separate, manual, and late-stage activity \u2014 when they test it at all. The result is predictable: critical vulnerabilities are only discovered during occasional audits, far removed from the development cycle where they would be cheaper to fix.<\/p>
This presentation explores how to integrate the OWASP API Security Top 10 into the regular testing cycle, turning risks such as Broken Object Level Authorization (BOLA), broken authentication, and excessive data exposure into automated, repeatable checks. Drawing on real-world cases, we will explore the most critical risks in the Top 10, with concrete examples of exploitation and, more importantly, detection. We will demonstrate how tools QA professionals already know \u2014 Postman and automation frameworks such as Playwright \u2014 can address a significant proportion of these risks without requiring a dedicated security specialist or additional budget.<\/p>
The central theme is mapping each OWASP item to the exact point in the pipeline where it should be tested: what functional tests can validate, what requires a dedicated security test, and what can \u2014 and should \u2014 run automatically with every build.\n\nThe goal is practical: to equip API testers with a set of techniques they can start applying the following Monday, demonstrating that security testing is not a separate discipline, but a natural extension of QA work.\n\nAttendees will leave the session with a clear, actionable roadmap \u2014 not just an abstract list of threats.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"
Bruna Santos QA Test Lead @ Devoteam Bruna Santos \u00e9 l\u00edder de QA na Devoteam Portugal, com mais de 13 anos de experi\u00eancia em testes de software em sectores como ciberseguran\u00e7a, banca, finan\u00e7as e telecomunica\u00e7\u00f5es. Especializou-se na interse\u00e7\u00e3o entre qualidade e seguran\u00e7a, com trabalho pr\u00e1tico em OWASP, Burp Suite, testes de APIs e automa\u00e7\u00e3o. Antes da Devoteam, liderou a \u00e1rea de Qualidade na AnubisNetworks, empresa de ciberseguran\u00e7a, onde desenvolveu testes de seguran\u00e7a e automa\u00e7\u00e3o aplicada. Bruna Santos QA Test Lead @ Devoteam Bruna Santos \u00e9 l\u00edder de QA na Devoteam Portugal, com mais de 13 anos de experi\u00eancia em testes de software em sectores como ciberseguran\u00e7a, banca, finan\u00e7as e telecomunica\u00e7\u00f5es. Especializou-se na interse\u00e7\u00e3o entre qualidade e seguran\u00e7a, com trabalho pr\u00e1tico em OWASP, Burp Suite, testes de APIs e automa\u00e7\u00e3o. Antes da Devoteam, liderou a \u00e1rea de Qualidade na AnubisNetworks, empresa de ciberseguran\u00e7a, onde desenvolveu testes de seguran\u00e7a e automa\u00e7\u00e3o aplicada. Bruna Santos QA Test Lead @ Devoteam Bruna Santos \u00e9 l\u00edder de QA na Devoteam Portugal, com mais de 13 anos de experi\u00eancia em testes de software em sectores como ciberseguran\u00e7a, banca, finan\u00e7as e telecomunica\u00e7\u00f5es. Especializou-se na interse\u00e7\u00e3o entre qualidade e seguran\u00e7a, com trabalho pr\u00e1tico em OWASP, Burp Suite, testes de APIs e automa\u00e7\u00e3o. Antes da Devoteam, liderou a \u00e1rea de Qualidade na AnubisNetworks, empresa de ciberseguran\u00e7a, onde desenvolveu testes de seguran\u00e7a e automa\u00e7\u00e3o aplicada. CALEND\u00c1RIO Call for Speakers 27 Outubro OWASP API Security Top 10 na Pr\u00e1tica: Do Pentest Manual ao Pipeline de QA A maioria das equipas de QA testa funcionalidade de APIs exaustivamente, mas trata a seguran\u00e7a como uma fase separada, manual e tardia \u2014 quando existe. O resultado \u00e9 previs\u00edvel: vulnerabilidades cr\u00edticas s\u00f3 aparecem em auditorias pontuais, longe do ciclo de desenvolvimento onde seriam baratas de corrigir. Esta apresenta\u00e7\u00e3o mostra como integrar o OWASP API Security Top 10 no ciclo normal de testes, transformando riscos como Broken Object Level Authorization (BOLA), autentica\u00e7\u00e3o quebrada e exposi\u00e7\u00e3o excessiva de dados em verifica\u00e7\u00f5es automatizadas e repet\u00edveis. Partindo de casos reais, percorremos os riscos mais cr\u00edticos do Top 10 com exemplos concretos de explora\u00e7\u00e3o e, mais importante, de dete\u00e7\u00e3o. Demonstramos como ferramentas que o QA j\u00e1 domina \u2014 Postman e Frameworks de automa\u00e7\u00e3o como Playwright \u2014 cobrem grande parte destes riscos sem exigir um perfil dedicado de seguran\u00e7a nem or\u00e7amento adicional. O fio condutor \u00e9 o mapeamento entre cada item do OWASP e o ponto exato do pipeline onde deve ser testado: o que valida o teste funcional, o que exige um teste de seguran\u00e7a espec\u00edfico, e o que pode (e deve) correr automaticamente em cada build. O objetivo \u00e9 pr\u00e1tico: dar a quem testa APIs um conjunto de t\u00e9cnicas aplic\u00e1veis na segunda-feira seguinte, mostrando que “security testing” n\u00e3o \u00e9 um mundo \u00e0 parte, mas uma extens\u00e3o natural do trabalho de QA. Sai-se da sess\u00e3o com um mapa claro e acion\u00e1vel, n\u00e3o com uma lista de amea\u00e7as abstratas. Calend\u00e1rio Call for Speakers 27 Outubro OWASP API Security Top 10 na Pr\u00e1tica: Do Pentest Manual ao Pipeline de QA A maioria das equipas de QA testa funcionalidade de APIs exaustivamente, mas trata a seguran\u00e7a como uma fase separada, manual e tardia \u2014 quando existe. O resultado \u00e9 previs\u00edvel: vulnerabilidades cr\u00edticas s\u00f3 aparecem em auditorias pontuais, longe do ciclo de desenvolvimento onde seriam baratas de corrigir. Esta apresenta\u00e7\u00e3o mostra como integrar o OWASP API Security Top 10 no ciclo normal de testes, transformando riscos como Broken Object Level Authorization (BOLA), autentica\u00e7\u00e3o quebrada e exposi\u00e7\u00e3o excessiva de dados em verifica\u00e7\u00f5es automatizadas e repet\u00edveis. Partindo de casos reais, percorremos os riscos mais cr\u00edticos do Top 10 com exemplos concretos de explora\u00e7\u00e3o e, mais importante, de dete\u00e7\u00e3o. Demonstramos como ferramentas que o QA j\u00e1 domina \u2014 Postman e Frameworks de automa\u00e7\u00e3o como Playwright \u2014 cobrem grande parte destes riscos sem exigir um perfil dedicado de seguran\u00e7a nem or\u00e7amento adicional. O fio condutor \u00e9 o mapeamento entre cada item do OWASP e o ponto exato do pipeline onde deve ser testado: o que valida o teste funcional, o que exige um teste de seguran\u00e7a espec\u00edfico, e o que pode (e deve) correr automaticamente em cada build. O objetivo \u00e9 pr\u00e1tico: dar a quem testa APIs um conjunto de t\u00e9cnicas aplic\u00e1veis na segunda-feira seguinte, mostrando que “security testing” n\u00e3o \u00e9 um mundo \u00e0 parte, mas uma extens\u00e3o natural do trabalho de QA. Sai-se da sess\u00e3o com um mapa claro e acion\u00e1vel, n\u00e3o com uma lista de amea\u00e7as abstratas.<\/p>","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"page-builder","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-14090","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/pages\/14090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/comments?post=14090"}],"version-history":[{"count":7,"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/pages\/14090\/revisions"}],"predecessor-version":[{"id":14108,"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/pages\/14090\/revisions\/14108"}],"wp:attachment":[{"href":"https:\/\/testingportugal.pstqb.pt\/en\/wp-json\/wp\/v2\/media?parent=14090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Bruna Santos<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
QA Test Lead @ Devoteam<\/span><\/strong><\/a><\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t \n\t\t\t

QA Test Lead @ Devoteam<\/span><\/strong><\/a><\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t \n\t\t\t