The Qodex blog
Guides from Qodex, the autonomous QA and security engineer, on AI QA, API and UI testing, security testing and AI code review.
What Is API Testing? Types, Examples & Best Practices
Build an API testing strategy: nine test types, what each checks, the process, manual vs scripted vs agent work, best practices and a checklist.
Read the article
All articles
Codex Code Review: Setup, Limits, and a Separate Reviewer
Set up Codex code review on GitHub, write AGENTS.md review rules, see which ChatGPT plans include it, and add a reviewer that did not write the code.
Playwright Codegen: Record and Clean Up a Test
Playwright codegen records a browser flow as test code. Record one against a local app, see the options, then turn the recording into a test that fails.
Playwright Fixtures: Scope, Setup and Teardown
Playwright fixtures set up what a test needs and clean it up after. Built-in fixtures, test.extend, worker scope, auto and option fixtures, with a run log.
API Management Security: Gateway and Admin Controls
API management security covers gateway policies and the admin plane behind them. What to enforce, what the service must still check, and policy tests.
Mobile App API Security: Tokens, Pinning, Tests
Mobile app API security starts on the server: treat the app as untrusted, use PKCE, rotate refresh tokens, check object access. Runnable tests included.
API Endpoint Security: Controls and Negative Tests
API endpoint security means each route enforces its own access rules. Build an endpoint inventory, a control matrix, and tests that prove each denial.
AI Pull Request Review: How Qodex Checks a Change
What happens when Qodex reviews a pull request: pinned scanners on changed lines, a model that checks each hit, live probes, and the merge check.
AI Penetration Testing: What Works in 2026
What AI penetration testing automates, where it fails, a checklist, and AI pentest tool prices read 11 November 2026, beside a human-signed pentest.
10 SonarQube Alternatives Compared for 2026
Compare 10 SonarQube alternatives by code quality, security, deployment, pricing, and limits. See when Codacy, Snyk, or Semgrep fits.
Payment Gateway API Testing: Engineer's Guide
Test a payment gateway API with safe sandboxes, Stripe test cards, idempotency, signed webhooks, declines, refunds, 3DS, and reconciliation.
AI Agent Testing: A Practical Guide to Evals
Learn how to test AI agents for task success, tool use, plans, safety, cost, and prompt or tool regressions, with a runnable test design.
Enterprise Software Testing: A Practical Guide
Learn to test ERP, CRM, integrations, data, controls, environments, and release trains with a practical enterprise operating model and checklist.