Every surface of your app — not just the endpoints
API testing is live today. UI, application workflow, and VAPT are already provisioned in every project. Here's what's shipped, what's next, and the decisions behind both.
One project, four ways to break it
Every project carries all four surfaces from day one. The three that aren't shipped yet are provisioned as coming soon — visible in the app, not hidden in a blog post.
API Live
Upload Postman, OpenAPI, or cURL. BugVilla generates 7 test categories and runs them as every persona — access matrix included. Reports in PDF, HTML, CSV, and JSON.
UI Coming soon
Browser-driven checks against your front end. The same personas that hit your endpoints will click through your screens — no second credential setup.
Application workflow Coming soon
Multi-step journeys that cross API and UI: sign up on a screen, assert the record over the API, follow the whole flow as each role.
VAPT Coming soon
Vulnerability assessment and penetration testing as its own surface — building outward from the security probes and access matrix running today.
Each new surface reuses what already exists: your project, your personas and their credentials, and the same report pipeline. Nothing gets set up twice.
Shipped, and what's next
No quarter-labelled swimlanes. Shipped runs today; Next is the order we're building in — not a promise of dates.
Shipped The full API cycle
- Upload & parse. Postman v2.1, OpenAPI 3.x / Swagger 2.0, raw cURL — method, params, body schema, auth, and examples extracted per endpoint.
- Persona detection. Login endpoint, credential fields, and token path found in your collection; you confirm once, each role authenticates once per run.
- 7 generated categories. Functional, contract, negative, boundary, security, performance — and the cross-persona access matrix.
- Versioned collections. v2 appends to a lineage, contract diff flags breaking changes, and a docs-only re-export shows zero changes.
- Reports in 4 formats. PDF and HTML for people, CSV and JSON for machines — one dataset, plus trends and run-to-run diffs.
Next On the API module
- Object-level authorization (BOLA). The matrix answers "may this role call this endpoint?" Next: "may this user reach another user's record?" — per-persona fixtures with cross-fed ids.
- Alerting on new exposures. Persona-aware scheduled runs that notify you when an endpoint a role couldn't reach yesterday returns 2xx today.
- Shareable read-only reports. Report branding plus a link you can hand to an auditor — no workspace login required.
- Distributed runners. Fan large collections out across workers instead of one queue.
- Live run logs over SSE. Watch cases stream in as they execute rather than polling for progress.
- AI-assisted test data. Generated request bodies and inferred request order, so chained flows need less hand-holding.
Decisions you can hold us to
Three engineering notes from the codebase — the kind of reasoning you can expect from every item above.
HTML reports are self-contained
Reports get emailed, then opened offline weeks later on machines we don't control. So the HTML report embeds everything it needs — no CDN, no external assets, nothing left to 404.
PDFs are drawn directly
No headless browser printing a page to PDF. The document is drawn straight from the same report data as every other format — fewer moving parts, and a finding can't exist in one export and not another.
Endpoints matched by METHOD /path
Collection ids don't survive a re-export, so versions are matched by METHOD /path instead. The fingerprint hash covers only what tests depend on — a docs-only re-export diffs to zero.
Start on the surface that's live today
Upload a collection, confirm your personas, and read your first access matrix. The other three surfaces will light up inside the same project — no migration, no re-setup.