After ChatGPT flagged that mdserver might allow path traversal attacks, I used Bruno, an under-development Postman/Insomnia alternative, to check whether Express was sanitizing URLs properly. ChatGPT generated pass and fail URL examples, I wrote asserts for each in Bruno, and the whole collection can be run at once. A side benefit is that requests are stored as version-controllable text committed alongside the rest of the code...
After Insomnia forced account creation and my saved API requests disappeared, I switched to Bruno, a free and open-source API client available for Mac, Windows, and Linux, plus a CLI and VS Code plugins. Bruno stores request collections as human-readable text files, making them easy to commit to source control alongside code. The writeup includes my first impressions after an afternoon of use...
