I spent 30 minutes chasing failing pytest runs before realizing our WAF throttled localhost because my mock SQLi payloads looked too convincing. Now my test harness URL-encodes attack strings and I added a staging-only rule to let CI through, which feels like I’m threat modeling… my threat model. Anyone else end up securing the tests harder than prod thanks to CSP, ASLR flags, and overzealous rate limits?
Ran into this with pytest too when WAF flagged “mock SQLi payloads”; I fixed it by tagging CI requests with an X-Test-Traffic header and adding a staging-only skip rule scoped to that header plus our CI IPs. Tiny caveat: rotate the header value and explicitly deny it in prod so the bypass can’t leak if someone copies the harness.
@csmith203 I go lighter: bump CRS threshold in staging for ‘mock SQLi’ payloads.