A comprehensive testing framework for evaluating LLM responses on API security topics using DeepEval and OpenAI.

This project provides a complete testing suite for validating LLM-generated security advice and responses. It focuses on:

• API Security: Authentication, authorization, and common vulnerabilities
• Accuracy Testing: Ensuring responses are relevant and factually correct
• Hallucination Detection: Preventing fabricated or misleading security advice
• RAG Evaluation: Testing retrieval-augmented generation quality
• Prompt Regression: Comparing prompt versions and preventing regressions
• Inference Provider: Uses OpenAI for LLM inference

startDeepEval/
├── .github/
│   └── workflows/
│       └── deepeval.yml          # CI/CD pipeline
├── datasets/
│   ├── golden_dataset.json       # Golden test cases for accuracy
│   └── rag_dataset.json          # RAG test cases with retrieval context
├── src/
│   ├── __init__.py
│   ├── llm_client.py             # OpenAI client for security responses
│   ├── rag_client.py             # OpenAI RAG client with knowledge base
````markdown
# DeepEval Security Testing Starter

A comprehensive testing framework for evaluating LLM responses on API security topics using DeepEval and OpenAI.

## 🔐 Overview

This project provides a complete testing suite for validating LLM-generated security advice and responses. It focuses on:

- **API Security**: Authentication, authorization, and common vulnerabilities
- **Accuracy Testing**: Ensuring responses are relevant and factually correct
- **Hallucination Detection**: Preventing fabricated or misleading security advice
- **RAG Evaluation**: Testing retrieval-augmented generation quality
- **Prompt Regression**: Comparing prompt versions and preventing regressions

## 📁 Project Structure

startDeepEval/ ├── .github/ │ └── workflows/ │ └── deepeval.yml # CI/CD pipeline ├── datasets/ │ ├── golden_dataset.json # Golden test cases for accuracy │ └── rag_dataset.json # RAG test cases with retrieval context ├── src/ │ ├── init.py │ ├── llm_client.py # OpenAI client for security responses │ ├── rag_client.py # OpenAI RAG client with knowledge base │ └── prompt_versions.py # Prompt version management ├── tests/ │ ├── init.py │ ├── conftest.py # Pytest fixtures │ ├── test_accuracy.py # Accuracy and relevancy tests │ ├── test_hallucination.py # Hallucination detection tests │ ├── test_rag.py # RAG retrieval and generation tests │ └── test_prompt_regression.py # Prompt version regression tests ├── deepeval_results/ # Test results output directory ├── .env.example # Environment variables template ├── requirements.txt # Python dependencies ├── pyproject.toml # Project configuration ├── pytest.ini # Pytest configuration └── README.md # This file

## 🚀 Getting Started

### Prerequisites

- Python 3.9+
- OpenAI API key

### Installation

1. **Clone the repository**:
   ```bash
   git clone <your-repo-url>
   cd startDeepEval

2. Install Python dependencies:

   pip install -r requirements.txt

3. Set up environment variables:

   cp .env.example .env
   # Edit .env and add your OpenAI API key:
   # OPENAI_API_KEY=your_api_key_here

Run all tests:

pytest

Run specific test categories:

# Accuracy tests
pytest tests/test_accuracy.py

# Hallucination detection
pytest tests/test_hallucination.py

# RAG tests
pytest tests/test_rag.py

# Prompt regression
pytest tests/test_prompt_regression.py

Run with markers:

# Run only security tests
pytest -m security

# Run everything except slow tests
pytest -m "not slow"

• AnswerRelevancyMetric: Measures how relevant the response is to the query
• FaithfulnessMetric: Ensures responses are grounded in provided context
• ContextualRelevancyMetric: Validates context relevance to the query

• HallucinationMetric: Detects fabricated information not supported by context
• BiasMetric: Identifies biased or unfair recommendations

• ContextualPrecisionMetric: Measures precision of retrieved context
• ContextualRecallMetric: Evaluates completeness of retrieved context
• ContextualRelevancyMetric: Assesses overall retrieval quality

• GEval: Custom criteria-based evaluation for comprehensiveness and quality
• Version Comparison: Ensures new prompts don't regress on key metrics

• Test discovery patterns
• Output formatting
• Custom markers for organizing tests
• Logging configuration

# Required: OpenAI API Key
OPENAI_API_KEY=your_key_here
OPENAI_MODEL=gpt-4o-mini

# DeepEval configuration
DEEPEVAL_TELEMETRY_OPT_OUT=true  # Optional
CONFIDENCE_THRESHOLD=0.7         # Optional: default threshold

from deepeval import assert_test
from deepeval.test_case import LLMTestCase
from deepeval.metrics import AnswerRelevancyMetric

def test_my_security_feature(llm_client):
    query = "How do I secure my API?"
    response = llm_client.generate_security_response(query)
    
    test_case = LLMTestCase(
        input=query,
        actual_output=response
    )
    
    metric = AnswerRelevancyMetric(threshold=0.7)
    assert_test(test_case, [metric])

def test_rag_retrieval(rag_client):
    query = "How do I prevent SQL injection?"
    result = rag_client.generate_rag_response(query)
    
    test_case = LLMTestCase(
        input=query,
        actual_output=result["response"],
        retrieval_context=result["retrieval_context"]
    )
    
    metric = ContextualRelevancyMetric(threshold=0.6)
    assert_test(test_case, [metric])

The project includes a GitHub Actions workflow (.github/workflows/deepeval.yml) that:

• Runs on push to main/develop branches
• Runs on pull requests
• Executes weekly on Sunday (for regression detection)
• Requires OpenAI API key configured as GitHub secret

Add your OpenAI API key as a repository secret:

1. Go to your repository settings
2. Navigate to Secrets and variables > Actions
3. Add a new repository secret:
   • Name: OPENAI_API_KEY
   • Value: Your OpenAI API key

Then push to trigger automated testing:

git push origin dev

1. Security Chatbot Validation: Ensure your security chatbot provides accurate advice
2. Documentation QA: Validate generated security documentation
3. Prompt Engineering: Test and compare different prompt versions
4. Compliance: Verify responses align with security standards (OWASP, NIST)
5. Regression Testing: Catch quality degradation in model updates
6. Privacy-Conscious Testing: Run tests using OpenAI with appropriate handling of sensitive data

• DeepEval Documentation
• OpenAI API Documentation
• OWASP Top 10

1. Fork the repository
2. Create a feature branch
3. Add tests for new features
4. Ensure all tests pass
5. Submit a pull request

MIT License - feel free to use this starter template for your projects.