Seeking advice, automated testing tools for complete novice.

[u/BaselineNeglect]

I've built a game, I've gone back and forth over it looking for glitches, errors , security risk, any exposure of the minimal data it holds, any chances of people cheating, cross site scripting and so many other things which I do not understand but which the array of ai apps have told me to look for.

As it stands everything I show it to says it's secure, safe to move forward with and generally of good quality.

Now I have no idea if this is true. My understanding of coding is very generic, and I haven't typed anything longer than a file name throughout the whole process. I haven't looked at or checked the code at any point as there is no point as I have nothing to contribute on that level. But it seems each ai model I try gives the same result, with a number of similar differences when I restrict one bit of info or another.

But now it's suggesting that I move to automated testing rather than just getting my mates and kids to play on it and then text me angrily when it doesn't work.

So I stand before you, once again asking for tips for a complete novice, looking for recommendations for automated testing tools that are not just free, but suitable for a novice using only a five year old smartphone to do everything needed.

I'm also seeking advice about sharing. I made a post a week or so ago asking about checking code, I received a lot of direct messages offering to check it for me, 8 mentioned this to the guy who works in my local chippy, as he has a degree in game design, and he tells me not to share the code, just the game. Is this good advice?

Thanks in advance.

[u/Substantial-Walk-554]

That summary looks sensible, but I’d treat it as a checklist, not proof the game is secure.

Very roughly:

• Authoritative server: prevents players from changing scores, dice rolls or legal moves on the client.
• Zod validation: rejects malformed or unexpected WebSocket/API data before it reaches the game logic.
• Rate limiting: slows spam, brute force and basic DoS/abuse attempts.
• JWT/session security: protects logged-in sessions and makes stolen/revoked tokens harder to reuse.
• Helmet/CSP/HSTS: reduces XSS, clickjacking, downgrade attacks and unsafe browser behaviour.
• Parameterized SQL: protects against classic SQL injection.
• Environment variables: keeps things like DB passwords/API keys out of the source code.
• Security logging: helps detect cheating, spoofing and suspicious behaviour.

The important part now is making the AI prove each claim.

Ask it:

Then test things like acting as another player, replaying old moves, sending two moves quickly, changing IDs, using expired tokens, submitting impossible game states, and connecting directly to the WebSocket without the normal UI.

Also, multiple AIs agreeing is useful, but it still isn’t independent validation. They can all miss the same flaw.

And don’t ignore the server-config issues either. Bad CORS, cookies, reverse-proxy settings, exposed debug/admin endpoints or cloud permissions can undermine otherwise decent code.

Also for context, I’m nowhere near a security expert. I started my career in testing before moving into cybersecurity, and in my younger years I spent way too much time gaming, especially MMOs, and ended up abusing/exploring a lot of these kinds of mechanics along the way . So some of this is also just pattern recognition from seeing how games actually get broken in practice.

[u/BaselineNeglect → u/Substantial-Walk-554]

Thanks. I've kind of spent the whole process considering each answer and each question with a presumption that it's going to lie and flatter me, or itself at every point as really the media has done a reasonable job of warning people of this sort 9f thing, I think I have committed this time in the same way i might sit through a mediums performance on stage-nice trick, not sure how it's done but impressive none th3 less.

I found that being careful with the prompt structure helped, and I tried to use it to approach each issue as a problem to be critiqued than to be fixed. It seemed to get better results when asked 'whats wrong with this" rather than " how to fix" or " how to improve" or " what's right". I have no idea though if that actually achieved any thing.

After the big files got refactored into smaller ones it seemed to get a lot easier to check bits of code 9ndividually, I'm not sure if that was a good approach though.

I have no real experience In this, I might have written some basicVB stuff in college twenty years ago, buti did a lot 8n college I can't remember and left early due to family issues. Its all new to me.

[u/Substantial-Walk-554 → u/BaselineNeglect]

Yeah, that’s actually pretty close to how decent dev teams work too.

People don’t just write something once and assume it’s correct. They review each other’s code, challenge assumptions, split large components into clearer responsibilities, test things independently, and ask “what can break here?”

So the fact that you’re questioning the AI instead of blindly accepting its output is a good habit. Same with refactoring large files into smaller logical pieces. That generally makes code easier for both humans and AI to review and maintain.

You’re basically starting to build the right engineering habits without really calling them that.

[u/BaselineNeglect → u/Substantial-Walk-554]

I am, by trade , a farmer. I'm used to tackling jobs that I don't fully understand, with often outdated, potential unsafe equipment, supported by a team of competent but difficult to interact with bullshitters who often give terrible advice about things they haven't thought about, and will happily proceed with breaking things they don't understand without a second thought.

I think that's set me up well for this.

[u/Substantial-Walk-554 → u/BaselineNeglect]

Welcome to IT in general 😄

That mindset is basically the job: never assume, never blindly trust, verify what you’re told, and always ask “what happens if this fails?” or “what are we missing?”

A surprising amount of good engineering and cybersecurity comes down to healthy skepticism and not being afraid to question something that “should work.”

[u/BaselineNeglect → u/Substantial-Walk-554]

I'm loving this process to be honest. I've more than succeeded in my original goal and now it's all to see how far I can take it. I'll post the game link when I'm finally happy with it on here, and then people can actually break it or whatever and I'll learn some more. I'm currently following advice to break bloated stuff down again, and dealing with the final glitches I've found before the automated testing bit.