GitLab

There was nothing. Every claim about this project rested on somebody having
checked it by hand once, which does not survive the next change.

245 tests covering sign in, roles, the users API, CSRF and the security
headers, the pages, the fencing decision, failback, account replication and the
tunnel keys. They run in a test image built on top of the production one, so
what is tested is the layers that ship rather than a separate environment that
drifts. Each test gets its own data directory, its own database and its own
settings, and inherited MYC_ variables are cleared, so running the suite on a
node cannot reach the manager running on it.

Three of them describe holes rather than features, which is the point:

A page only checked that somebody was signed in, not that they were allowed.
The API refused a viewer and the navigation hid the link, but the page itself
returned 200 to anybody with a session. Nothing leaked, because the data comes
from the endpoints, and it would have leaked th...