My forms have validation, but I suspect some of it only lives in the browser. I want tests proving the server enforces the rules even when the client doesn't. First, list my app's forms and the validation rules each one appears to have (required fields, formats, lengths, allowed values). Then, for each form's server endpoint, write tests that bypass the client entirely and submit raw requests: 1. Missing required fields. 2. Values that violate format rules (bad emails, bad URLs, letters in numeric fields). 3. Strings longer than the field should accept. 4. Values outside allowed ranges or enum sets (for example, a plan name that doesn't exist, a negative quantity). 5. Extra fields the form never renders, in case the endpoint blindly writes request fields to the database (a mass-assignment hole). For each case, assert the server rejects it with a useful error and, critically, that nothing was written to the database. The mass-assignment case matters most: if your test can set `role` or `is_admin` or a price by adding a field to the request, stop and flag it immediately. That's a real vulnerability. When finished, run the suite and summarize: which forms enforce their rules server-side, which are client-only, and whether any endpoint trusts fields it shouldn't.