[poobags]

Are the requests being only replayed, or is there some amount of mutation going on too, to potentially reach buggy states?

If the latter, I'm wondering how it might compare to tooling with a similar intent, e.g. https://www.microsoft.com/en-us/research/publication/restler...?

[royal0203]

As of now, no automated mutation although we do give option to modify the request by developers

In my experience, fuzzy testing is more helpful from Dast / security testing perspective and we were thinking of adding these later.