Guides
Guides for privacy-safe API testing
Practical writing on test fixtures, API privacy, and developer workflows. Written for backend and QA engineers who care about how the sausage gets made.
Understand the problem
How to create realistic test fixtures without copying production data
Hand-written fixtures rot; copying production data is a compliance liability. Here are three approaches to realistic test fixtures, and the trade-offs each one forces.
Masking PII in API test data: a practical guide
What actually counts as PII in request/response payloads, why shape-preserving masking matters for tests, and where in your pipeline masking must happen.
GDPR and test data: can you use production data in staging?
Personal data in staging is still personal data under GDPR. Here is what purpose limitation and data minimisation actually require for non-production environments.
Why your API mocks drift from reality (and how to stop it)
Hand-written mocks are accurate on day one and silently wrong by month six. Here are the specific drift modes, why green CI doesn't protect you, and how to fix it.
Compare approaches
Record-and-replay API testing: VCR, Polly.js, nock, and WireMock compared
An honest comparison of VCR, Polly.js, nock, and WireMock for record-and-replay API testing, covering recording model, replay fidelity, and the cleartext data problem all of them share.
Recorded stubs vs. contract testing: complementary, not competing
Contract testing and recorded stubs catch different failure modes. Here's what each actually verifies, where each breaks down, and how to run both in the same CI pipeline.
How-to
Capture API traffic from Express in five minutes
Add Stubsmith's capture middleware to an Express app, define masking rules before any traffic flows, and start accumulating real-shape test fixtures in minutes.
Replaying API stubs in GitHub Actions
Run your test suite against real-traffic-shaped API stubs in CI without live third-party calls, production secrets in your environment, or flaky network dependencies.
Writing masking rules that fail closed
How to write Stubsmith masking rules that default to protecting data rather than exposing it: field-family patterns, value-shape matching, and the fail-closed posture.