Schemathesis Trophy Case
Real-world defects uncovered by Schemathesis’ property-based testing engine.
Bug Categories
| Type | Description |
|---|---|
| 💥 Server Crashes | 5xx responses or crashes triggered by unexpected inputs |
| 📋 Schema Violations | Responses that violate the published contract |
| 🚪 Validation Bypass | Invalid or malicious data accepted by the API |
| 🔗 Integration Issues | Incompatibilities between clients and servers |
Submitting a Trophy
What we're looking for
Bugs in APIs that other developers use or recognize (open-source projects with active communities, public SaaS APIs, popular tools).
Security vulnerabilities should follow responsible-disclosure rules; only document them here once the fix is public.
Discoveries
| Project | Type | What Schemathesis found |
|---|---|---|
| vLLM | 💥 Server Crashes | POST /v1/messages returned 500 when stop_sequences carried more than four items. |
| vLLM | 💥 Server Crashes | An empty trace-replay token list returned 500 instead of a client error. |
| Qdrant | 💥 Server Crashes | Validation panicked when two sibling items failed at once, dropping the connection without a response. |
| Qdrant | 🚪 Validation Bypass | Write operations accepted timeout=0 although the schema declares minimum: 1. |
| OpenObserve | 💥 Server Crashes | Two handler panics reachable from query parameters — a divide by zero on ?limit=0 and an unwrap() on ?query=. |
| OpenObserve | 💥 Server Crashes | A control byte in a field name made header construction fail, replacing the handler's 400 with a bare 500. |
| Ory Kratos | 📋 Schema Violations | A sweep of the public API found responses and status codes that the shipped OpenAPI definition does not describe. |
| Goa | 📋 Schema Violations | The framework's default error responses — 400, 408, 500, 503, 504 — never reach the generated document. |
| TypeSpec | 📋 Schema Violations | The SSE emitter produced an unsatisfiable oneOf branch, so a conforming validator rejected every frame. |
| Huma | 💥 Server Crashes | uniqueItems validation ran before type casting, crashing the server thread on certain primitive inputs. |
| CivetWeb | 🔗 Integration Issues | Unsupported HTTP methods answered 400 instead of 405. |
| API Platform | 💥 Server Crashes | A large page value returned 500 — the offset overflowed into a float where an integer was required. |
| Horse | 🔗 Integration Issues | 405 responses omitted the Allow header required by RFC 9110. |
| Vert.x OpenAPI | 💥 Server Crashes | Query parameters were percent-decoded twice during validation, so %25 reached the handler as a 500. |