When you build a security app as a solo developer, the hardest engineering problem isn't writing the defense code — it's QA and resilience testing.
Security software operates under a bizarre constraint: nothing happening is the normal state. The software only does its job when something hostile or anomalous occurs.
The trouble is, when you write your own test scripts, you subconsciously test what you expect. You launch a test server, watch the port get blocked, nod, and mark it green. But real attackers and weird production environments don't follow the developer's script. They poke at edge cases, state machine bugs, and race conditions between subsystems.
To break my own bias, I set up a local uncensored model (qwen3.8-27b-uncensored) running locally on my Mac via OpenCode as a dedicated Adversarial QA Tester, pointed it at a disposable macOS VM (Tart), and told it to find holes in my app, RoamSwitch.
Here is what that stress test surfaced, the edge cases it broke, and how I fixed them.
