Untitled

Goal
We want a small PoC that shows we can run lightweight security checks inline with our Playwright E2E flows (no separate runner). The idea is to mutate requests during a test run (headers / query / body / path) with simple attack payloads (XSS / SQLi / header injection) and validate basic responses (status codes, reflected payloads, obvious stack traces, missing security headers).

Approach (short)
	•	We’ll add a small “security adapter” (middleware) around existing request calls.
	•	It will be switchable (normal vs attack mode) and configurable (which attacks, how many iterations).
	•	For the PoC we’ll implement 2 attack types (XSS, basic SQLi) and a couple of simple validators.
	•	Failures will be attached to the normal test report (payload + response) so devs can triage.

Why this way
	•	Minimal disruption — we reuse current tests/CI/reporting.
	•	Fast to prove value: no big infra changes and easy to extend later.
	•	Keeps baseline runs untouched when adapter is off.