DEV Community: Rodolpho Sa

How to Structure Your API Security Testing with OWASP ASTF 🚀

Rodolpho Sa — Fri, 04 Sep 2026 13:23:55 +0000

If you work in DevSecOps, backend development, or cybersecurity, you’ve likely noticed that traditional vulnerability scanners often fall short when testing APIs. The reason? They don't understand your application's business logic.

That’s where the OWASP API Security Testing Framework (ASTF) comes in.

Unlike general reference lists like the OWASP API Security Top 10, the ASTF provides a practical, structured guide on how to perform API security audits and penetration testing in real-world scenarios.

🎯 Why Use This Framework?
Focus on Business Logic: Helps identify complex authorization flaws (BOLA / BFLA) that automated scanners miss.

Standardization: Establishes a clear testing checklist so QA, Security, and Dev teams speak the same language.

Comprehensive Coverage: Guides security testing across REST, GraphQL, SOAP, and Webhook integrations.

🔍 How Does ASTF Structure the Testing Phases?
Reconnaissance & Discovery: Mapping exposed endpoints, leftover documentation (e.g., outdated OpenAPI/Swagger files), and hidden parameters.

Authentication & Session Management: Assessing weak JWT implementations, OAuth2 flows, and session flaws.

Access Control (Authorization): Systematically testing horizontal and vertical access controls (ID tampering, privilege escalation).

Input Validation & Error Handling: Checking for Injection, parameter tampering, boundary errors, and sensitive data leakage.

Rate Limiting & Resilience: Testing resource exhaustion limits and application-level Denial of Service (DoS).

💡 Takeaway:
Securing APIs goes far beyond running an automated ZAP or Burp Suite scan and waiting for a clean report. It requires a methodology focused on how APIs actually fail in production.

If you’re building a security pipeline or looking to improve your manual/automated API testing, bookmark this repository!

🔗 Official GitHub Repository: https://github.com/OWASP/www-project-api-security-testing-framework

APISecurity #DevSecOps #AppSec #OWASP #Cybersecurity #SoftwareEngineering #PenetrationTesting

From Python to Go: rewriting a CrewAI workflow in pure stdlib

Rodolpho Sa — Thu, 20 Aug 2026 14:08:50 +0000

In the CrewAI Python framework you assemble teams of agents that collaborate via LLMs. It’s a great model when tasks require multiple specialists. But pulling in litellm, langchain, pydantic and friends makes cold starts heavy and deployment a container story.

A few months ago I started crewai-go, an idiomatic Go port with zero external dependencies. The whole core package is pure net/http, encoding/json, log/slog and friends.

This post walks through a minimal port of the canonical CrewAI “research → write” example, side-by-side with the Python version.

Python (CrewAI)

from crewai import Agent, Crew, Process, Task

researcher = Agent(
    role="Senior Researcher",
    goal="Uncover the best practices in concurrency",
    backstory="You are a veteran engineer with deep distributed-systems chops.",
)

writer = Agent(
    role="Tech Writer",
    goal="Write a concise summary",
    backstory="You turn research into tight prose.",
)

research = Task(description="Research Go concurrency best practices",
                expected_output="Bullet list of 5 best practices", agent=researcher)
write    = Task(description="Write a 1-paragraph summary from the research",
                expected_output="A single paragraph", agent=writer)

crew = Crew(agents=[researcher, writer], tasks=[research, write],
            process=Process.sequential)
print(crew.kickoff().final)

Go (crewai-go)

package main

import (
    "context"
    "fmt"

    "github.com/rhgs/crewai-go"
    "github.com/rhgs/crewai-go/llm/openai"
)

func main() {
    llm := openai.New("gpt-4o-mini") // uses OPENAI_API_KEY
    researcher := crewai.NewAgent(
        "Senior Researcher",
        "Uncover the best practices in concurrency",
        "You are a veteran engineer with deep distributed-systems chops.",
        llm,
    )
    writer := crewai.NewAgent(
        "Tech Writer",
        "Write a concise summary",
        "You turn research into tight prose.",
        llm,
    )

    research := crewai.NewTask(
        "Research Go concurrency best practices",
        "Bullet list of 5 best practices",
        researcher,
    )
    write := crewai.NewTask(
        "Write a 1-paragraph summary from the research",
        "A single paragraph",
        writer,
    ).WithContext(research) // explicit dependency, like CrewAI’s context

    crew := crewai.NewCrew([]*crewai.Agent{researcher, writer},
                           []*crewai.Task{research, write})
    out, _ := crew.Kickoff(context.Background(), nil)
    fmt.Println(out.Final)
}

Same surface, different runtime
Same concepts: Agent, Task, Crew, Process.
Sequential, Hierarchical and Staged processes (stages run in sequence; tasks within a stage run concurrently).
Agentic loop (opt-in Plan–Execute–Evaluate–Refine) with an independent evaluator and bounded refinements.
Web search, structured output with JSON Schema repair loop, guardrails, facts & provenance — all of it built on stdlib only.

Why port it?

Single binary (GOOS=linux GOARCH=arm64 go build from your laptop).
Millisecond cold start, ~10–20 MB memory footprint.
Thread-safe end-to-end; CI runs go test -race.
~94% test coverage, hard 90% gate.

Try it

git clone https://github.com/rhgs/crewai-go
cd crewai-go
export OPENAI_API_KEY=sk-...
go run ./examples/sequential

There’s also examples/agentic_loop which runs fully offline with a mock LLM — no API key needed.

If you’re a Go developer working on LLM orchestration, give it a star, file an issue, or open a PR. The CONTRIBUTING guide is bilingual (English + Brazilian Portuguese) and the PR checklist is short.

Repo: https://github.com/rhgs/crewai-go v0.4.0 release: https://github.com/rhgs/crewai-go/releases/tag/v0.4.0

Happy hacking.

🚀 crewai-go v0.4.0 is live!

Rodolpho Sa — Mon, 17 Aug 2026 21:27:56 +0000

If you love the multi-agent AI orchestration concepts from Python’s CrewAI, but want the performance, native concurrency, and low memory footprint of Go, check out crewai-go.

The v0.4.0 release brings key capabilities to make building multi-agent systems in Go fast, type-safe, and production-ready.

✨ Key Highlights:

🛠️ Custom Tools: Easily create and bind custom tools using tools.NewTool(...).

🔄 Sequential Context Flow: Outputs from previous tasks flow directly into subsequent tasks as context.

📦 Structured Outputs: Map LLM responses straight into native Go structs using standard json:"..." tags.

🏠 Flexible Provider Support: Run fully offline with Ollama or integrate seamlessly with OpenAI.

🧠 Short-Term Memory: Agents keep context across complex task executions.

💡 Quick Example:

package main

import (
    "context"
    "fmt"
    "log"

    "github.com/rhgs/crewai-go/crew"
)

func main() {
    researcher := crew.NewAgent(crew.AgentConfig{
        Role:      "AI Researcher",
        Goal:      "Analyze tech trends",
        Backstory: "An expert in discovering high-impact open-source Go tools.",
    })

    task := crew.NewTask(crew.TaskConfig{
        Description:    "Summarize the main benefits of using Go for AI agent orchestration.",
        ExpectedOutput: "3 concise bullet points.",
        Agent:          researcher,
    })

    c := crew.NewCrew(crew.CrewConfig{
        Agents: []*crew.Agent{researcher},
        Tasks:  []*crew.Task{task},
    })

    result, err := c.Kickoff(context.Background())
    if err != nil {
        log.Fatal(err)
    }

    fmt.Println(result.Raw)
}

🔗 Release details & GitHub repo:
github.com/rhgs/crewai-go/releases/tag/v0.4.0