diff --git a/.github/workflows/php-lint.yml b/.github/workflows/php-lint.yml
index 0e83136..804d020 100644
--- a/.github/workflows/php-lint.yml
+++ b/.github/workflows/php-lint.yml
@@ -10,6 +10,7 @@ on:
       - 'composer.json'
       - 'composer.lock'
       - 'phpstan.neon'
+      - 'phpunit.xml'
       - '.php-cs-fixer.dist.php'
       - '.github/workflows/php-lint.yml'
   pull_request:
@@ -19,6 +20,7 @@ on:
       - 'composer.json'
       - 'composer.lock'
       - 'phpstan.neon'
+      - 'phpunit.xml'
       - '.php-cs-fixer.dist.php'
       - '.github/workflows/php-lint.yml'
 
@@ -285,6 +287,58 @@ jobs:
         run: |
           composer audit --format=plain || echo "::warning::Vulnerabilities found in dependencies"
 
+  # ============================================================
+  # Unit Tests - PHPUnit with coverage
+  # ============================================================
+  tests:
+    name: Unit Tests (PHPUnit)
+    runs-on: ubuntu-latest
+    needs: syntax
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # v2.32.0
+        with:
+          php-version: ${{ env.PHP_VERSION }}
+          extensions: xdebug
+          coverage: xdebug
+          tools: phpunit:10
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --no-interaction
+
+      - name: Run PHPUnit tests
+        run: |
+          vendor/bin/phpunit --coverage-text --coverage-clover=coverage/clover.xml
+
+      - name: Check coverage threshold
+        run: |
+          # Extract coverage percentage from clover.xml
+          if [ -f coverage/clover.xml ]; then
+            COVERAGE=$(php -r "
+              \$xml = simplexml_load_file('coverage/clover.xml');
+              \$metrics = \$xml->project->metrics;
+              \$elements = (int)\$metrics['elements'];
+              \$covered = (int)\$metrics['coveredelements'];
+              if (\$elements > 0) {
+                echo round((\$covered / \$elements) * 100, 2);
+              } else {
+                echo '0';
+              }
+            ")
+            echo "Code coverage: ${COVERAGE}%"
+            echo "## Test Coverage: ${COVERAGE}%" >> $GITHUB_STEP_SUMMARY
+
+            # Fail if coverage is below 70%
+            if (( $(echo "$COVERAGE < 70" | bc -l) )); then
+              echo "::warning::Coverage is below 70% threshold"
+            fi
+          fi
+
   # ============================================================
   # Multi-version PHP Test - Ensure compatibility
   # ============================================================
@@ -324,7 +378,7 @@ jobs:
   lint-summary:
     name: Lint Summary
     runs-on: ubuntu-latest
-    needs: [syntax, code-style, phpstan, license-headers, strict-types, security-patterns, composer-audit, php-compat]
+    needs: [syntax, code-style, phpstan, tests, license-headers, strict-types, security-patterns, composer-audit, php-compat]
     if: always()
     permissions:
       contents: read
@@ -338,6 +392,7 @@ jobs:
           echo "| Syntax | ${{ needs.syntax.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| Code Style | ${{ needs.code-style.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| PHPStan | ${{ needs.phpstan.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Unit Tests | ${{ needs.tests.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| License Headers | ${{ needs.license-headers.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| Strict Types | ${{ needs.strict-types.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
           echo "| Security Patterns | ${{ needs.security-patterns.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
@@ -348,6 +403,7 @@ jobs:
           if [ "${{ needs.syntax.result }}" != "success" ] || \
              [ "${{ needs.code-style.result }}" != "success" ] || \
              [ "${{ needs.phpstan.result }}" != "success" ] || \
+             [ "${{ needs.tests.result }}" != "success" ] || \
              [ "${{ needs.strict-types.result }}" != "success" ] || \
              [ "${{ needs.security-patterns.result }}" != "success" ]; then
             echo ""
diff --git a/SECURE_DEFAULTS.md b/SECURE_DEFAULTS.md
index ce85e4d..ac9d560 100644
--- a/SECURE_DEFAULTS.md
+++ b/SECURE_DEFAULTS.md
@@ -4,6 +4,7 @@ This document provides a comprehensive checklist for secure PHP development usin
 
 ## Table of Contents
 
+- [OWASP Top 10 Mapping](#owasp-top-10-mapping)
 - [PHP Configuration](#php-configuration)
 - [Input Validation](#input-validation)
 - [Output Sanitization](#output-sanitization)
@@ -18,6 +19,329 @@ This document provides a comprehensive checklist for secure PHP development usin
 
 ---
 
+## OWASP Top 10 Mapping
+
+This section maps php-aegis features and checklist items to the [OWASP Top 10 2021](https://owasp.org/Top10/) vulnerabilities.
+
+### Summary Matrix
+
+| OWASP ID | Vulnerability | php-aegis Coverage | Section |
+|----------|--------------|-------------------|---------|
+| A01:2021 | Broken Access Control | Partial (Headers) | [HTTP Headers](#http-security-headers) |
+| A02:2021 | Cryptographic Failures | Guidelines | [Cryptography](#cryptography) |
+| A03:2021 | Injection | **Full** (Validator, Sanitizer, TurtleEscaper) | [Input](#input-validation), [Output](#output-sanitization) |
+| A04:2021 | Insecure Design | Guidelines | [All Sections](#secure-defaults-checklist) |
+| A05:2021 | Security Misconfiguration | **Full** (Headers) | [HTTP Headers](#http-security-headers), [PHP Config](#php-configuration) |
+| A06:2021 | Vulnerable Components | Guidelines | [Dependencies](#dependency-management) |
+| A07:2021 | Auth Failures | Guidelines | [Authentication](#authentication--sessions) |
+| A08:2021 | Data Integrity Failures | Partial (CSP) | [HTTP Headers](#http-security-headers) |
+| A09:2021 | Logging Failures | Guidelines | [Error Handling](#error-handling) |
+| A10:2021 | SSRF | Partial (Validator) | [Input Validation](#input-validation) |
+
+---
+
+### A01:2021 - Broken Access Control
+
+**Risk:** Attackers access unauthorized resources or perform actions outside their permissions.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Code Example |
+|---------|------------------|--------------|
+| CSRF Prevention | `Headers::secure()` sets SameSite cookies | `Headers::secure()` |
+| Clickjacking | `Headers::frameOptions('DENY')` | `Headers::frameOptions()` |
+| CORS Policies | `Headers::crossOrigin*Policy()` | `Headers::crossOriginResourcePolicy()` |
+
+**Checklist:**
+- [ ] Use `Headers::frameOptions('DENY')` to prevent clickjacking
+- [ ] Implement proper session management (see [Authentication](#authentication--sessions))
+- [ ] Validate user permissions on every request
+- [ ] Use CSRF tokens for state-changing operations
+- [ ] Apply principle of least privilege
+
+---
+
+### A02:2021 - Cryptographic Failures
+
+**Risk:** Sensitive data exposed due to weak/missing encryption.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Code Example |
+|---------|------------------|--------------|
+| HTTPS Enforcement | `Validator::httpsUrl()` | `Validator::httpsUrl($url)` |
+| HSTS | `Headers::strictTransportSecurity()` | `Headers::strictTransportSecurity(31536000, true, true)` |
+
+**Checklist:**
+- [ ] Use `Validator::httpsUrl()` to reject non-HTTPS URLs
+- [ ] Enable HSTS with `Headers::strictTransportSecurity()`
+- [ ] Never use MD5/SHA1 for security (see [Cryptography](#cryptography))
+- [ ] Use `random_bytes()` for secure random data
+- [ ] Use Argon2id for password hashing
+
+**CI Enforcement:**
+```yaml
+# In php-lint.yml - checks for weak cryptography
+- name: Check weak cryptography
+  run: grep -rEn 'md5\s*\(|sha1\s*\(' --include="*.php" src/
+```
+
+---
+
+### A03:2021 - Injection
+
+**Risk:** Untrusted data interpreted as commands (SQL, XSS, OS, LDAP, Turtle).
+
+**php-aegis Mitigations:**
+
+| Attack Type | php-aegis Feature | Code Example |
+|-------------|------------------|--------------|
+| XSS (HTML) | `Sanitizer::html()` | `echo Sanitizer::html($input)` |
+| XSS (Attr) | `Sanitizer::attr()` | `value="<?= Sanitizer::attr($v) ?>"` |
+| XSS (JS) | `Sanitizer::js()` | `var x = <?= Sanitizer::js($v) ?>` |
+| Path Traversal | `Validator::safeFilename()` | `Validator::safeFilename($name)` |
+| Null Byte | `Validator::noNullBytes()` | `Validator::noNullBytes($path)` |
+| RDF/SPARQL | `TurtleEscaper::string()` | `TurtleEscaper::literal($v)` |
+| URL Injection | `Sanitizer::url()` | `href="<?= Sanitizer::url($u) ?>"` |
+| JSON Injection | `Sanitizer::json()` | `Sanitizer::json($data)` |
+
+**Checklist:**
+- [ ] Use `Sanitizer::html()` for all HTML output
+- [ ] Use `Sanitizer::attr()` for HTML attributes
+- [ ] Use `Sanitizer::js()` for inline JavaScript
+- [ ] Use `Sanitizer::json()` for JSON responses
+- [ ] Use `TurtleEscaper::literal()` for RDF/Turtle data
+- [ ] Use `Validator::safeFilename()` for file operations
+- [ ] Use prepared statements for ALL database queries
+
+**CI Enforcement:**
+```yaml
+# In php-lint.yml - checks for injection patterns
+- name: Check dangerous functions
+  run: |
+    grep -rEn 'eval\s*\(|exec\s*\(' --include="*.php" src/
+    grep -rEn 'echo\s+\$_(GET|POST)' --include="*.php" src/
+```
+
+---
+
+### A04:2021 - Insecure Design
+
+**Risk:** Missing or ineffective security controls in application design.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Purpose |
+|---------|------------------|---------|
+| Secure Defaults | `Headers::secure()` | One-call security setup |
+| Type Safety | All methods require `string` types | Prevents type confusion |
+| Fail Secure | Validators return `false` on invalid input | Reject by default |
+
+**Checklist:**
+- [ ] Call `Headers::secure()` early in every request
+- [ ] Use `declare(strict_types=1)` in all PHP files
+- [ ] Validate before processing, sanitize before output
+- [ ] Reject invalid input (don't try to "fix" it)
+- [ ] Design with defense in depth
+
+---
+
+### A05:2021 - Security Misconfiguration
+
+**Risk:** Missing security hardening, default credentials, verbose errors.
+
+**php-aegis Mitigations:**
+
+| Misconfiguration | php-aegis Feature | Code Example |
+|-----------------|------------------|--------------|
+| Missing CSP | `Headers::contentSecurityPolicy()` | `Headers::secure()` |
+| Missing HSTS | `Headers::strictTransportSecurity()` | `Headers::secure()` |
+| Server Leakage | `Headers::removeInsecureHeaders()` | `Headers::secure()` |
+| MIME Sniffing | `Headers::contentTypeOptions()` | `Headers::secure()` |
+| Missing Permissions-Policy | `Headers::permissionsPolicy()` | `Headers::secure()` |
+
+**Headers set by `Headers::secure()`:**
+```
+Content-Security-Policy: default-src 'self'
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+X-XSS-Protection: 1; mode=block
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: geolocation=(), camera=(), microphone=(), payment=()
+```
+
+**Checklist:**
+- [ ] Call `Headers::secure()` on every response
+- [ ] Configure PHP securely (see [PHP Configuration](#php-configuration))
+- [ ] Disable `display_errors` in production
+- [ ] Remove default credentials and accounts
+- [ ] Review all security headers with [securityheaders.com](https://securityheaders.com)
+
+---
+
+### A06:2021 - Vulnerable and Outdated Components
+
+**Risk:** Using libraries with known vulnerabilities.
+
+**php-aegis Design:**
+- **Zero runtime dependencies** - Only PHP 8.1+ built-ins
+- No vulnerable dependencies to track in production
+
+**Checklist:**
+- [ ] Run `composer audit` on every CI build
+- [ ] Keep PHP version updated (8.1+ required)
+- [ ] Review dev dependencies before adding
+- [ ] Enable Dependabot/Renovate for automatic updates
+
+**CI Enforcement:**
+```yaml
+# In php-lint.yml
+- name: Run Composer audit
+  run: composer audit --format=plain
+```
+
+---
+
+### A07:2021 - Identification and Authentication Failures
+
+**Risk:** Weak passwords, session hijacking, credential stuffing.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Purpose |
+|---------|------------------|---------|
+| Session Security | `Headers::secure()` sets cookie flags | SameSite, Secure |
+
+**Checklist:**
+- [ ] Use `password_hash()` with `PASSWORD_ARGON2ID`
+- [ ] Use `password_verify()` for constant-time comparison
+- [ ] Regenerate session ID on login (`session_regenerate_id(true)`)
+- [ ] Set session cookie flags: HttpOnly, Secure, SameSite=Strict
+- [ ] Implement rate limiting for authentication
+- [ ] Use MFA for sensitive operations
+
+---
+
+### A08:2021 - Software and Data Integrity Failures
+
+**Risk:** Untrusted code execution, insecure CI/CD, missing integrity checks.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Purpose |
+|---------|------------------|---------|
+| CSP | `Headers::contentSecurityPolicy()` | Prevents inline script injection |
+| SRI Support | Design for external script verification | Subresource Integrity |
+
+**Checklist:**
+- [ ] Use Content-Security-Policy to block inline scripts
+- [ ] Pin GitHub Actions to commit SHAs (not tags)
+- [ ] Verify `composer.lock` in CI builds
+- [ ] Sign commits with GPG
+- [ ] Use Subresource Integrity for CDN resources
+
+**CI Enforcement:**
+```yaml
+# Pin actions to SHA for integrity
+- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+```
+
+---
+
+### A09:2021 - Security Logging and Monitoring Failures
+
+**Risk:** Insufficient logging, missing alerting, undetected breaches.
+
+**Checklist:**
+- [ ] Log authentication attempts (success and failure)
+- [ ] Log access control failures
+- [ ] Log input validation failures (potential attacks)
+- [ ] Don't log sensitive data (passwords, tokens, PII)
+- [ ] Set up alerting for anomalous patterns
+- [ ] Monitor error logs for security issues
+
+**Error Handler Pattern:**
+```php
+set_exception_handler(function (Throwable $e): void {
+    // Log for operators
+    error_log(sprintf('[%s] %s', get_class($e), $e->getMessage()));
+
+    // Generic response to users
+    http_response_code(500);
+    echo json_encode(['error' => 'An unexpected error occurred']);
+    exit(1);
+});
+```
+
+---
+
+### A10:2021 - Server-Side Request Forgery (SSRF)
+
+**Risk:** Attacker forces server to make requests to unintended destinations.
+
+**php-aegis Mitigations:**
+
+| Control | php-aegis Feature | Code Example |
+|---------|------------------|--------------|
+| URL Validation | `Validator::url()` | `Validator::url($url)` |
+| HTTPS Enforcement | `Validator::httpsUrl()` | `Validator::httpsUrl($url)` |
+| Hostname Validation | `Validator::hostname()` | `Validator::hostname($host)` |
+| IP Validation | `Validator::ip()`, `ipv4()`, `ipv6()` | `Validator::ip($ip)` |
+
+**Checklist:**
+- [ ] Validate all user-supplied URLs with `Validator::url()`
+- [ ] Prefer `Validator::httpsUrl()` to enforce HTTPS
+- [ ] Maintain allowlist of permitted domains/IPs
+- [ ] Block requests to internal/private IP ranges
+- [ ] Don't follow redirects blindly
+
+**Safe URL Fetching:**
+```php
+use PhpAegis\Validator;
+
+function safeFetch(string $url): string {
+    // Validate URL format
+    if (!Validator::httpsUrl($url)) {
+        throw new InvalidArgumentException('Invalid or non-HTTPS URL');
+    }
+
+    // Parse and validate hostname
+    $host = parse_url($url, PHP_URL_HOST);
+    if (!$host || !Validator::domain($host)) {
+        throw new InvalidArgumentException('Invalid hostname');
+    }
+
+    // Block internal/private IPs (allowlist approach is better)
+    $ip = gethostbyname($host);
+    if (filter_var($ip, FILTER_VALIDATE_IP,
+        FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
+        throw new InvalidArgumentException('Private/reserved IP not allowed');
+    }
+
+    // Now safe to fetch
+    return file_get_contents($url);
+}
+```
+
+---
+
+### OWASP Coverage Summary
+
+| php-aegis Class | OWASP Categories Addressed |
+|----------------|---------------------------|
+| `Validator` | A03, A10 |
+| `Sanitizer` | A03 |
+| `Headers` | A01, A02, A04, A05, A08 |
+| `TurtleEscaper` | A03 |
+
+**Legend:**
+- **Full Coverage**: php-aegis provides direct protection
+- **Partial Coverage**: php-aegis helps but additional measures needed
+- **Guidelines**: Documentation and checklists provided
+
+---
+
 ## PHP Configuration
 
 ### Required Settings
diff --git a/phpunit.xml b/phpunit.xml
new file mode 100644
index 0000000..43cbab4
--- /dev/null
+++ b/phpunit.xml
@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- SPDX-License-Identifier: MIT OR AGPL-3.0-or-later -->
+<phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         bootstrap="vendor/autoload.php"
+         cacheDirectory=".phpunit.cache"
+         executionOrder="depends,defects"
+         requireCoverageMetadata="false"
+         beStrictAboutCoverageMetadata="true"
+         beStrictAboutOutputDuringTests="true"
+         failOnRisky="true"
+         failOnWarning="true"
+         colors="true"
+         displayDetailsOnTestsThatTriggerDeprecations="true"
+         displayDetailsOnTestsThatTriggerErrors="true"
+         displayDetailsOnTestsThatTriggerNotices="true"
+         displayDetailsOnTestsThatTriggerWarnings="true">
+    <testsuites>
+        <testsuite name="default">
+            <directory>tests</directory>
+        </testsuite>
+    </testsuites>
+
+    <source restrictDeprecations="true"
+            restrictNotices="true"
+            restrictWarnings="true">
+        <include>
+            <directory>src</directory>
+        </include>
+    </source>
+
+    <coverage includeUncoveredFiles="true"
+              pathCoverage="false"
+              ignoreDeprecatedCodeUnits="true"
+              disableCodeCoverageIgnore="false">
+        <report>
+            <html outputDirectory="coverage/html"/>
+            <clover outputFile="coverage/clover.xml"/>
+            <text outputFile="php://stdout" showOnlySummary="true"/>
+        </report>
+    </coverage>
+</phpunit>
diff --git a/tests/HeadersTest.php b/tests/HeadersTest.php
new file mode 100644
index 0000000..350ea49
--- /dev/null
+++ b/tests/HeadersTest.php
@@ -0,0 +1,537 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT OR AGPL-3.0-or-later
+ * SPDX-FileCopyrightText: 2024-2025 Hyperpolymath
+ */
+
+declare(strict_types=1);
+
+namespace PhpAegis\Tests;
+
+use InvalidArgumentException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\RunInSeparateProcess;
+use PHPUnit\Framework\TestCase;
+use PhpAegis\Headers;
+
+#[CoversClass(Headers::class)]
+final class HeadersTest extends TestCase
+{
+    // =========================================================================
+    // Frame Options (OWASP A01 - Broken Access Control / Clickjacking)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testFrameOptionsDefault(): void
+    {
+        Headers::frameOptions();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-Frame-Options: DENY', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testFrameOptionsDeny(): void
+    {
+        Headers::frameOptions('DENY');
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-Frame-Options: DENY', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testFrameOptionsSameOrigin(): void
+    {
+        Headers::frameOptions('SAMEORIGIN');
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-Frame-Options: SAMEORIGIN', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testFrameOptionsAllowFrom(): void
+    {
+        Headers::frameOptions('ALLOW-FROM https://example.com');
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-Frame-Options: ALLOW-FROM https://example.com', $headers);
+    }
+
+    public function testFrameOptionsRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('X-Frame-Options must be DENY, SAMEORIGIN, or ALLOW-FROM uri');
+
+        Headers::frameOptions('INVALID');
+    }
+
+    // =========================================================================
+    // Content-Type Options (OWASP A05 - Security Misconfiguration)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testContentTypeOptions(): void
+    {
+        Headers::contentTypeOptions();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-Content-Type-Options: nosniff', $headers);
+    }
+
+    // =========================================================================
+    // XSS Protection (OWASP A03 - Legacy Browser Protection)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testXssProtectionDefault(): void
+    {
+        Headers::xssProtection();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-XSS-Protection: 1; mode=block', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testXssProtectionEnabled(): void
+    {
+        Headers::xssProtection(true, true);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-XSS-Protection: 1; mode=block', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testXssProtectionEnabledNoBlock(): void
+    {
+        Headers::xssProtection(true, false);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-XSS-Protection: 1', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testXssProtectionDisabled(): void
+    {
+        Headers::xssProtection(false);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('X-XSS-Protection: 0', $headers);
+    }
+
+    // =========================================================================
+    // Referrer Policy (OWASP A05 - Security Misconfiguration)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testReferrerPolicyDefault(): void
+    {
+        Headers::referrerPolicy();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Referrer-Policy: strict-origin-when-cross-origin', $headers);
+    }
+
+    #[DataProvider('validReferrerPoliciesProvider')]
+    #[RunInSeparateProcess]
+    public function testReferrerPolicyValid(string $policy): void
+    {
+        Headers::referrerPolicy($policy);
+
+        $headers = xdebug_get_headers();
+        self::assertContains("Referrer-Policy: {$policy}", $headers);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validReferrerPoliciesProvider(): array
+    {
+        return [
+            'no-referrer' => ['no-referrer'],
+            'no-referrer-when-downgrade' => ['no-referrer-when-downgrade'],
+            'origin' => ['origin'],
+            'origin-when-cross-origin' => ['origin-when-cross-origin'],
+            'same-origin' => ['same-origin'],
+            'strict-origin' => ['strict-origin'],
+            'strict-origin-when-cross-origin' => ['strict-origin-when-cross-origin'],
+            'unsafe-url' => ['unsafe-url'],
+        ];
+    }
+
+    public function testReferrerPolicyRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Invalid Referrer-Policy');
+
+        Headers::referrerPolicy('invalid-policy');
+    }
+
+    // =========================================================================
+    // Strict Transport Security (OWASP A02 - Cryptographic Failures)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testStrictTransportSecurityDefault(): void
+    {
+        Headers::strictTransportSecurity();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Strict-Transport-Security: max-age=31536000; includeSubDomains', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testStrictTransportSecurityWithPreload(): void
+    {
+        Headers::strictTransportSecurity(31536000, true, true);
+
+        $headers = xdebug_get_headers();
+        self::assertContains(
+            'Strict-Transport-Security: max-age=31536000; includeSubDomains; preload',
+            $headers
+        );
+    }
+
+    #[RunInSeparateProcess]
+    public function testStrictTransportSecurityNoSubdomains(): void
+    {
+        Headers::strictTransportSecurity(86400, false, false);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Strict-Transport-Security: max-age=86400', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testStrictTransportSecurityCustomMaxAge(): void
+    {
+        Headers::strictTransportSecurity(3600);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Strict-Transport-Security: max-age=3600; includeSubDomains', $headers);
+    }
+
+    // =========================================================================
+    // Content Security Policy (OWASP A03, A05, A08)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testContentSecurityPolicySingleDirective(): void
+    {
+        Headers::contentSecurityPolicy([
+            'default-src' => ["'self'"],
+        ]);
+
+        $headers = xdebug_get_headers();
+        self::assertContains("Content-Security-Policy: default-src 'self'", $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testContentSecurityPolicyMultipleDirectives(): void
+    {
+        Headers::contentSecurityPolicy([
+            'default-src' => ["'self'"],
+            'script-src' => ["'self'", 'https://cdn.example.com'],
+            'style-src' => ["'self'", "'unsafe-inline'"],
+        ]);
+
+        $headers = xdebug_get_headers();
+
+        // Find the CSP header
+        $cspHeader = null;
+        foreach ($headers as $header) {
+            if (str_starts_with($header, 'Content-Security-Policy:')) {
+                $cspHeader = $header;
+                break;
+            }
+        }
+
+        self::assertNotNull($cspHeader);
+        self::assertStringContainsString("default-src 'self'", $cspHeader);
+        self::assertStringContainsString('script-src', $cspHeader);
+        self::assertStringContainsString('style-src', $cspHeader);
+    }
+
+    #[RunInSeparateProcess]
+    public function testContentSecurityPolicyReportOnly(): void
+    {
+        Headers::contentSecurityPolicy([
+            'default-src' => ["'self'"],
+        ], true);
+
+        $headers = xdebug_get_headers();
+
+        $found = false;
+        foreach ($headers as $header) {
+            if (str_starts_with($header, 'Content-Security-Policy-Report-Only:')) {
+                $found = true;
+                break;
+            }
+        }
+
+        self::assertTrue($found, 'Expected Content-Security-Policy-Report-Only header');
+    }
+
+    #[RunInSeparateProcess]
+    public function testContentSecurityPolicyEmptyDirective(): void
+    {
+        Headers::contentSecurityPolicy([
+            'upgrade-insecure-requests' => [],
+        ]);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Content-Security-Policy: upgrade-insecure-requests', $headers);
+    }
+
+    // =========================================================================
+    // Permissions Policy (OWASP A05 - Security Misconfiguration)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testPermissionsPolicyEmpty(): void
+    {
+        Headers::permissionsPolicy([
+            'camera' => [],
+            'microphone' => [],
+        ]);
+
+        $headers = xdebug_get_headers();
+
+        $found = null;
+        foreach ($headers as $header) {
+            if (str_starts_with($header, 'Permissions-Policy:')) {
+                $found = $header;
+                break;
+            }
+        }
+
+        self::assertNotNull($found);
+        self::assertStringContainsString('camera=()', $found);
+        self::assertStringContainsString('microphone=()', $found);
+    }
+
+    #[RunInSeparateProcess]
+    public function testPermissionsPolicySelf(): void
+    {
+        Headers::permissionsPolicy([
+            'geolocation' => ['self'],
+        ]);
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Permissions-Policy: geolocation=(self)', $headers);
+    }
+
+    #[RunInSeparateProcess]
+    public function testPermissionsPolicyWithOrigins(): void
+    {
+        Headers::permissionsPolicy([
+            'camera' => ['self', 'https://example.com'],
+        ]);
+
+        $headers = xdebug_get_headers();
+
+        $found = null;
+        foreach ($headers as $header) {
+            if (str_starts_with($header, 'Permissions-Policy:')) {
+                $found = $header;
+                break;
+            }
+        }
+
+        self::assertNotNull($found);
+        self::assertStringContainsString('camera=(self "https://example.com")', $found);
+    }
+
+    // =========================================================================
+    // Cross-Origin Policies (OWASP A01 - Broken Access Control)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testCrossOriginEmbedderPolicyDefault(): void
+    {
+        Headers::crossOriginEmbedderPolicy();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Cross-Origin-Embedder-Policy: require-corp', $headers);
+    }
+
+    #[DataProvider('validCoepPoliciesProvider')]
+    #[RunInSeparateProcess]
+    public function testCrossOriginEmbedderPolicyValid(string $policy): void
+    {
+        Headers::crossOriginEmbedderPolicy($policy);
+
+        $headers = xdebug_get_headers();
+        self::assertContains("Cross-Origin-Embedder-Policy: {$policy}", $headers);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validCoepPoliciesProvider(): array
+    {
+        return [
+            'require-corp' => ['require-corp'],
+            'credentialless' => ['credentialless'],
+            'unsafe-none' => ['unsafe-none'],
+        ];
+    }
+
+    public function testCrossOriginEmbedderPolicyRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        Headers::crossOriginEmbedderPolicy('invalid');
+    }
+
+    #[RunInSeparateProcess]
+    public function testCrossOriginOpenerPolicyDefault(): void
+    {
+        Headers::crossOriginOpenerPolicy();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Cross-Origin-Opener-Policy: same-origin', $headers);
+    }
+
+    #[DataProvider('validCoopPoliciesProvider')]
+    #[RunInSeparateProcess]
+    public function testCrossOriginOpenerPolicyValid(string $policy): void
+    {
+        Headers::crossOriginOpenerPolicy($policy);
+
+        $headers = xdebug_get_headers();
+        self::assertContains("Cross-Origin-Opener-Policy: {$policy}", $headers);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validCoopPoliciesProvider(): array
+    {
+        return [
+            'same-origin' => ['same-origin'],
+            'same-origin-allow-popups' => ['same-origin-allow-popups'],
+            'unsafe-none' => ['unsafe-none'],
+        ];
+    }
+
+    public function testCrossOriginOpenerPolicyRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        Headers::crossOriginOpenerPolicy('invalid');
+    }
+
+    #[RunInSeparateProcess]
+    public function testCrossOriginResourcePolicyDefault(): void
+    {
+        Headers::crossOriginResourcePolicy();
+
+        $headers = xdebug_get_headers();
+        self::assertContains('Cross-Origin-Resource-Policy: same-origin', $headers);
+    }
+
+    #[DataProvider('validCorpPoliciesProvider')]
+    #[RunInSeparateProcess]
+    public function testCrossOriginResourcePolicyValid(string $policy): void
+    {
+        Headers::crossOriginResourcePolicy($policy);
+
+        $headers = xdebug_get_headers();
+        self::assertContains("Cross-Origin-Resource-Policy: {$policy}", $headers);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validCorpPoliciesProvider(): array
+    {
+        return [
+            'same-origin' => ['same-origin'],
+            'same-site' => ['same-site'],
+            'cross-origin' => ['cross-origin'],
+        ];
+    }
+
+    public function testCrossOriginResourcePolicyRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        Headers::crossOriginResourcePolicy('invalid');
+    }
+
+    // =========================================================================
+    // Remove Insecure Headers (OWASP A05 - Security Misconfiguration)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testRemoveInsecureHeaders(): void
+    {
+        // Set headers that should be removed
+        header('X-Powered-By: PHP/8.3.0');
+        header('Server: Apache/2.4.41');
+
+        Headers::removeInsecureHeaders();
+
+        $headers = xdebug_get_headers();
+
+        // These headers should be removed
+        foreach ($headers as $header) {
+            self::assertStringNotContainsString('X-Powered-By', $header);
+            self::assertStringNotContainsString('Server:', $header);
+        }
+    }
+
+    // =========================================================================
+    // Secure() - All-in-one (OWASP A05 - Secure Defaults)
+    // =========================================================================
+
+    #[RunInSeparateProcess]
+    public function testSecureSetsAllHeaders(): void
+    {
+        Headers::secure();
+
+        $headers = xdebug_get_headers();
+
+        // Check for essential security headers
+        $hasContentType = false;
+        $hasFrameOptions = false;
+        $hasXssProtection = false;
+        $hasReferrerPolicy = false;
+        $hasHsts = false;
+        $hasCsp = false;
+        $hasPermissions = false;
+
+        foreach ($headers as $header) {
+            if (str_starts_with($header, 'X-Content-Type-Options:')) {
+                $hasContentType = true;
+            }
+            if (str_starts_with($header, 'X-Frame-Options:')) {
+                $hasFrameOptions = true;
+            }
+            if (str_starts_with($header, 'X-XSS-Protection:')) {
+                $hasXssProtection = true;
+            }
+            if (str_starts_with($header, 'Referrer-Policy:')) {
+                $hasReferrerPolicy = true;
+            }
+            if (str_starts_with($header, 'Strict-Transport-Security:')) {
+                $hasHsts = true;
+            }
+            if (str_starts_with($header, 'Content-Security-Policy:')) {
+                $hasCsp = true;
+            }
+            if (str_starts_with($header, 'Permissions-Policy:')) {
+                $hasPermissions = true;
+            }
+        }
+
+        self::assertTrue($hasContentType, 'Missing X-Content-Type-Options');
+        self::assertTrue($hasFrameOptions, 'Missing X-Frame-Options');
+        self::assertTrue($hasXssProtection, 'Missing X-XSS-Protection');
+        self::assertTrue($hasReferrerPolicy, 'Missing Referrer-Policy');
+        self::assertTrue($hasHsts, 'Missing Strict-Transport-Security');
+        self::assertTrue($hasCsp, 'Missing Content-Security-Policy');
+        self::assertTrue($hasPermissions, 'Missing Permissions-Policy');
+    }
+}
diff --git a/tests/SanitizerTest.php b/tests/SanitizerTest.php
new file mode 100644
index 0000000..6d5c707
--- /dev/null
+++ b/tests/SanitizerTest.php
@@ -0,0 +1,407 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT OR AGPL-3.0-or-later
+ * SPDX-FileCopyrightText: 2024-2025 Hyperpolymath
+ */
+
+declare(strict_types=1);
+
+namespace PhpAegis\Tests;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use PhpAegis\Sanitizer;
+
+#[CoversClass(Sanitizer::class)]
+final class SanitizerTest extends TestCase
+{
+    // =========================================================================
+    // HTML Escaping (OWASP A03 - XSS Prevention)
+    // =========================================================================
+
+    public function testHtmlEscapesBasicChars(): void
+    {
+        self::assertSame('&lt;script&gt;', Sanitizer::html('<script>'));
+        self::assertSame('&amp;', Sanitizer::html('&'));
+        self::assertSame('&quot;', Sanitizer::html('"'));
+        self::assertSame('&#039;', Sanitizer::html("'"));
+        self::assertSame('&lt;', Sanitizer::html('<'));
+        self::assertSame('&gt;', Sanitizer::html('>'));
+    }
+
+    #[DataProvider('xssVectorsProvider')]
+    public function testHtmlPreventsXss(string $attack, string $context): void
+    {
+        $sanitized = Sanitizer::html($attack);
+
+        // The sanitized output should not contain unescaped dangerous characters
+        self::assertStringNotContainsString('<script', $sanitized);
+        self::assertStringNotContainsString('javascript:', $sanitized);
+        self::assertStringNotContainsString('onerror=', $sanitized);
+
+        // Verify the original attack pattern is neutralized
+        self::assertNotSame($attack, $sanitized, "XSS vector should be modified: {$context}");
+    }
+
+    /**
+     * @return array<string, array{string, string}>
+     */
+    public static function xssVectorsProvider(): array
+    {
+        return [
+            'basic script' => ['<script>alert("XSS")</script>', 'script tag'],
+            'img onerror' => ['<img src=x onerror=alert(1)>', 'event handler'],
+            'svg onload' => ['<svg onload=alert(1)>', 'SVG event'],
+            'body onload' => ['<body onload=alert(1)>', 'body event'],
+            'iframe' => ['<iframe src="javascript:alert(1)">', 'iframe injection'],
+            'javascript url' => ['<a href="javascript:alert(1)">click</a>', 'javascript URL'],
+            'data url' => ['<a href="data:text/html,<script>alert(1)</script>">x</a>', 'data URL'],
+            'encoded' => ['<script>alert(String.fromCharCode(88,83,83))</script>', 'encoded XSS'],
+            'nested tags' => ['<<script>script>alert(1)<</script>/script>', 'nested bypass'],
+            'null byte' => ["<scr\x00ipt>alert(1)</script>", 'null byte bypass'],
+        ];
+    }
+
+    public function testHtmlPreservesUtf8(): void
+    {
+        self::assertSame('日本語', Sanitizer::html('日本語'));
+        self::assertSame('émoji 🎉', Sanitizer::html('émoji 🎉'));
+        self::assertSame('Ñoño', Sanitizer::html('Ñoño'));
+    }
+
+    public function testHtmlHandlesEmptyString(): void
+    {
+        self::assertSame('', Sanitizer::html(''));
+    }
+
+    // =========================================================================
+    // HTML Attribute Escaping (OWASP A03 - XSS Prevention)
+    // =========================================================================
+
+    public function testAttrEscapesQuotes(): void
+    {
+        self::assertSame('&quot;', Sanitizer::attr('"'));
+        self::assertSame('&#039;', Sanitizer::attr("'"));
+    }
+
+    public function testAttrPreventsAttributeBreakout(): void
+    {
+        // Attempt to break out of attribute
+        $attack = '" onclick="alert(1)"';
+        $sanitized = Sanitizer::attr($attack);
+
+        self::assertStringNotContainsString('onclick', $sanitized);
+        self::assertStringStartsWith('&quot;', $sanitized);
+    }
+
+    #[DataProvider('attrXssVectorsProvider')]
+    public function testAttrPreventsXss(string $attack): void
+    {
+        $sanitized = Sanitizer::attr($attack);
+
+        // Should not contain unquoted dangerous patterns
+        self::assertStringNotContainsString('" ', $sanitized);
+        self::assertStringNotContainsString("' ", $sanitized);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function attrXssVectorsProvider(): array
+    {
+        return [
+            'double quote breakout' => ['" onclick="alert(1)'],
+            'single quote breakout' => ["' onclick='alert(1)"],
+            'event handler' => ['x" onmouseover="alert(1)'],
+            'javascript in attr' => ['javascript:alert(1)'],
+        ];
+    }
+
+    // =========================================================================
+    // Strip Tags (OWASP A03 - XSS Prevention)
+    // =========================================================================
+
+    public function testStripTagsRemovesHtml(): void
+    {
+        self::assertSame('Hello World', Sanitizer::stripTags('<p>Hello World</p>'));
+        self::assertSame('alert(1)', Sanitizer::stripTags('<script>alert(1)</script>'));
+        self::assertSame('Click here', Sanitizer::stripTags('<a href="http://evil.com">Click here</a>'));
+    }
+
+    public function testStripTagsRemovesNestedTags(): void
+    {
+        self::assertSame('content', Sanitizer::stripTags('<div><p><span>content</span></p></div>'));
+    }
+
+    public function testStripTagsPreservesText(): void
+    {
+        self::assertSame('Plain text', Sanitizer::stripTags('Plain text'));
+        self::assertSame('', Sanitizer::stripTags(''));
+    }
+
+    // =========================================================================
+    // JavaScript Escaping (OWASP A03 - XSS Prevention)
+    // =========================================================================
+
+    public function testJsEscapesForJavaScript(): void
+    {
+        // Result is JSON-encoded string with extra escaping
+        $result = Sanitizer::js('Hello "World"');
+        self::assertSame('"Hello \u0022World\u0022"', $result);
+    }
+
+    public function testJsEscapesScriptTags(): void
+    {
+        $result = Sanitizer::js('</script><script>alert(1)');
+
+        // Should escape < and > to prevent script breakout
+        self::assertStringNotContainsString('</script>', $result);
+        self::assertStringContainsString('\u003C', $result);
+    }
+
+    public function testJsEscapesSingleQuotes(): void
+    {
+        $result = Sanitizer::js("It's a test");
+        self::assertStringContainsString('\u0027', $result);
+    }
+
+    public function testJsEscapesAmpersand(): void
+    {
+        $result = Sanitizer::js('foo & bar');
+        self::assertStringContainsString('\u0026', $result);
+    }
+
+    public function testJsHandlesUnicode(): void
+    {
+        $result = Sanitizer::js('日本語');
+        // Unicode should be preserved (JSON_UNESCAPED_UNICODE)
+        self::assertStringContainsString('日本語', $result);
+    }
+
+    public function testJsReturnsEmptyStringForEmpty(): void
+    {
+        self::assertSame('""', Sanitizer::js(''));
+    }
+
+    // =========================================================================
+    // CSS Escaping (OWASP A03 - XSS Prevention)
+    // =========================================================================
+
+    public function testCssRemovesDangerousChars(): void
+    {
+        // Only alphanumeric, spaces, hyphens, underscores allowed
+        self::assertSame('red', Sanitizer::css('red'));
+        self::assertSame('10px', Sanitizer::css('10px'));
+        self::assertSame('my-class', Sanitizer::css('my-class'));
+        self::assertSame('my_class', Sanitizer::css('my_class'));
+    }
+
+    public function testCssRemovesExpressions(): void
+    {
+        // CSS expression attacks
+        self::assertSame('expressionalert1', Sanitizer::css('expression(alert(1))'));
+        self::assertSame('urljavascriptalert1', Sanitizer::css('url(javascript:alert(1))'));
+    }
+
+    public function testCssRemovesSpecialChars(): void
+    {
+        self::assertSame('', Sanitizer::css('{}'));
+        self::assertSame('', Sanitizer::css('/**/'));
+        self::assertSame('', Sanitizer::css('<>'));
+        self::assertSame('', Sanitizer::css('";'));
+    }
+
+    public function testCssPreservesWhitespace(): void
+    {
+        self::assertSame('10 px', Sanitizer::css('10 px'));
+    }
+
+    // =========================================================================
+    // URL Encoding (OWASP A03, A10 - Injection Prevention)
+    // =========================================================================
+
+    public function testUrlEncodesSpecialChars(): void
+    {
+        self::assertSame('hello%20world', Sanitizer::url('hello world'));
+        self::assertSame('%3C%3E', Sanitizer::url('<>'));
+        self::assertSame('%22', Sanitizer::url('"'));
+        self::assertSame('%26', Sanitizer::url('&'));
+    }
+
+    public function testUrlEncodesSlashes(): void
+    {
+        self::assertSame('%2F', Sanitizer::url('/'));
+        self::assertSame('..%2F..%2Fetc%2Fpasswd', Sanitizer::url('../../etc/passwd'));
+    }
+
+    public function testUrlPreservesAlphanumeric(): void
+    {
+        self::assertSame('abc123', Sanitizer::url('abc123'));
+        self::assertSame('test-value', Sanitizer::url('test-value'));
+    }
+
+    public function testUrlHandlesUnicode(): void
+    {
+        // rawurlencode encodes Unicode to UTF-8 percent-encoded
+        $result = Sanitizer::url('日本語');
+        self::assertStringContainsString('%', $result);
+    }
+
+    // =========================================================================
+    // JSON Encoding (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testJsonEncodesWithSecurityFlags(): void
+    {
+        $data = ['key' => '<script>alert(1)</script>'];
+        $result = Sanitizer::json($data);
+
+        // Should escape HTML entities
+        self::assertStringNotContainsString('<', $result);
+        self::assertStringNotContainsString('>', $result);
+        self::assertStringContainsString('\u003C', $result);
+    }
+
+    public function testJsonEncodesQuotes(): void
+    {
+        $data = ['quote' => "It's \"quoted\""];
+        $result = Sanitizer::json($data);
+
+        self::assertStringContainsString('\u0027', $result); // Single quote
+        self::assertStringContainsString('\u0022', $result); // Double quote
+    }
+
+    public function testJsonHandlesNestedStructures(): void
+    {
+        $data = [
+            'level1' => [
+                'level2' => [
+                    'value' => '<xss>'
+                ]
+            ]
+        ];
+        $result = Sanitizer::json($data);
+
+        self::assertJson($result);
+        self::assertStringNotContainsString('<', $result);
+    }
+
+    public function testJsonHandlesEmptyArray(): void
+    {
+        self::assertSame('[]', Sanitizer::json([]));
+    }
+
+    public function testJsonHandlesNull(): void
+    {
+        self::assertSame('null', Sanitizer::json(null));
+    }
+
+    // =========================================================================
+    // Null Byte Removal (OWASP A03 - Path Traversal Prevention)
+    // =========================================================================
+
+    public function testRemoveNullBytes(): void
+    {
+        self::assertSame('file.php.jpg', Sanitizer::removeNullBytes("file.php\x00.jpg"));
+        self::assertSame('normal', Sanitizer::removeNullBytes('normal'));
+        self::assertSame('', Sanitizer::removeNullBytes("\x00\x00\x00"));
+    }
+
+    public function testRemoveNullBytesMultiple(): void
+    {
+        self::assertSame('abc', Sanitizer::removeNullBytes("a\x00b\x00c"));
+    }
+
+    // =========================================================================
+    // Filename Sanitization (OWASP A03 - Path Traversal Prevention)
+    // =========================================================================
+
+    public function testFilenameRemovesPathComponents(): void
+    {
+        self::assertSame('passwd', Sanitizer::filename('/etc/passwd'));
+        self::assertSame('passwd', Sanitizer::filename('../../../etc/passwd'));
+        self::assertSame('file.txt', Sanitizer::filename('C:\\Windows\\file.txt'));
+    }
+
+    public function testFilenameRemovesDangerousChars(): void
+    {
+        self::assertSame('file_name.txt', Sanitizer::filename('file<name>.txt'));
+        self::assertSame('file_name.txt', Sanitizer::filename('file;name.txt'));
+        self::assertSame('file_name.txt', Sanitizer::filename('file|name.txt'));
+    }
+
+    public function testFilenameRemovesNullBytes(): void
+    {
+        self::assertSame('file.txt', Sanitizer::filename("file.php\x00.txt"));
+    }
+
+    public function testFilenameRemovesHiddenPrefix(): void
+    {
+        self::assertSame('htaccess', Sanitizer::filename('.htaccess'));
+        self::assertSame('gitignore', Sanitizer::filename('.gitignore'));
+    }
+
+    public function testFilenamePreservesValidChars(): void
+    {
+        self::assertSame('my-file_123.txt', Sanitizer::filename('my-file_123.txt'));
+        self::assertSame('document.pdf', Sanitizer::filename('document.pdf'));
+    }
+
+    public function testFilenameHandlesSpaces(): void
+    {
+        // Spaces are converted to underscores
+        self::assertSame('my_file.txt', Sanitizer::filename('my file.txt'));
+    }
+
+    // =========================================================================
+    // Edge Cases and Security Boundary Tests
+    // =========================================================================
+
+    public function testAllMethodsHandleEmptyString(): void
+    {
+        self::assertSame('', Sanitizer::html(''));
+        self::assertSame('', Sanitizer::attr(''));
+        self::assertSame('', Sanitizer::stripTags(''));
+        self::assertSame('""', Sanitizer::js(''));
+        self::assertSame('', Sanitizer::css(''));
+        self::assertSame('', Sanitizer::url(''));
+        self::assertSame('', Sanitizer::removeNullBytes(''));
+        self::assertSame('', Sanitizer::filename(''));
+    }
+
+    public function testAllMethodsHandleLongStrings(): void
+    {
+        $longString = str_repeat('a', 100000);
+
+        // Should not throw or truncate unexpectedly
+        self::assertSame($longString, Sanitizer::html($longString));
+        self::assertSame($longString, Sanitizer::attr($longString));
+        self::assertSame($longString, Sanitizer::stripTags($longString));
+        self::assertSame($longString, Sanitizer::css($longString));
+    }
+
+    public function testHtmlDoubleEncodingPrevention(): void
+    {
+        // Double encoding: &amp; should become &amp;amp;
+        $input = '&amp;';
+        $result = Sanitizer::html($input);
+        self::assertSame('&amp;amp;', $result);
+
+        // This is correct behavior - we escape what we receive
+        // If already escaped, it gets double-escaped (safe but verbose)
+    }
+
+    public function testMixedAttackVectors(): void
+    {
+        // Combined attack attempting multiple vectors
+        $attack = '<script>alert("XSS")</script><img src=x onerror=alert(1)>';
+        $sanitized = Sanitizer::html($attack);
+
+        // All dangerous patterns should be escaped
+        self::assertStringNotContainsString('<script>', $sanitized);
+        self::assertStringNotContainsString('<img', $sanitized);
+        self::assertStringNotContainsString('onerror', $sanitized);
+    }
+}
diff --git a/tests/TurtleEscaperTest.php b/tests/TurtleEscaperTest.php
new file mode 100644
index 0000000..131cd52
--- /dev/null
+++ b/tests/TurtleEscaperTest.php
@@ -0,0 +1,394 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT OR AGPL-3.0-or-later
+ * SPDX-FileCopyrightText: 2024-2025 Hyperpolymath
+ */
+
+declare(strict_types=1);
+
+namespace PhpAegis\Tests;
+
+use InvalidArgumentException;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use PhpAegis\TurtleEscaper;
+
+/**
+ * Tests for RDF Turtle escaping utilities.
+ *
+ * These tests verify W3C Turtle specification compliance and
+ * prevent injection attacks in semantic web applications (OWASP A03).
+ *
+ * @see https://www.w3.org/TR/turtle/#sec-escapes
+ */
+#[CoversClass(TurtleEscaper::class)]
+final class TurtleEscaperTest extends TestCase
+{
+    // =========================================================================
+    // String Escaping (OWASP A03 - RDF Injection Prevention)
+    // =========================================================================
+
+    public function testStringEscapesBackslash(): void
+    {
+        self::assertSame('\\\\', TurtleEscaper::string('\\'));
+        self::assertSame('path\\\\to\\\\file', TurtleEscaper::string('path\\to\\file'));
+    }
+
+    public function testStringEscapesQuotes(): void
+    {
+        self::assertSame('\\"', TurtleEscaper::string('"'));
+        self::assertSame("\\'", TurtleEscaper::string("'"));
+        self::assertSame('He said \\"Hello\\"', TurtleEscaper::string('He said "Hello"'));
+    }
+
+    public function testStringEscapesControlCharacters(): void
+    {
+        self::assertSame('\\t', TurtleEscaper::string("\t"));
+        self::assertSame('\\n', TurtleEscaper::string("\n"));
+        self::assertSame('\\r', TurtleEscaper::string("\r"));
+        self::assertSame('\\b', TurtleEscaper::string("\x08")); // Backspace
+        self::assertSame('\\f', TurtleEscaper::string("\f"));
+    }
+
+    public function testStringEscapesOtherControlChars(): void
+    {
+        // Other control characters should be escaped with \uXXXX
+        self::assertSame('\\u0000', TurtleEscaper::string("\x00")); // Null
+        self::assertSame('\\u0001', TurtleEscaper::string("\x01")); // SOH
+        self::assertSame('\\u007F', TurtleEscaper::string("\x7F")); // DEL
+    }
+
+    public function testStringPreservesNormalText(): void
+    {
+        self::assertSame('Hello World', TurtleEscaper::string('Hello World'));
+        self::assertSame('The quick brown fox', TurtleEscaper::string('The quick brown fox'));
+    }
+
+    public function testStringPreservesUnicode(): void
+    {
+        self::assertSame('日本語', TurtleEscaper::string('日本語'));
+        self::assertSame('émoji 🎉', TurtleEscaper::string('émoji 🎉'));
+        self::assertSame('Ñoño', TurtleEscaper::string('Ñoño'));
+    }
+
+    public function testStringHandlesEmpty(): void
+    {
+        self::assertSame('', TurtleEscaper::string(''));
+    }
+
+    public function testStringComplexExample(): void
+    {
+        $input = "Line 1\nLine 2\twith\ttabs and \"quotes\"";
+        $expected = 'Line 1\\nLine 2\\twith\\ttabs and \\"quotes\\"';
+        self::assertSame($expected, TurtleEscaper::string($input));
+    }
+
+    #[DataProvider('turtleInjectionVectorsProvider')]
+    public function testStringPreventsInjection(string $attack, string $description): void
+    {
+        $escaped = TurtleEscaper::string($attack);
+
+        // The escaped version should not contain unescaped dangerous characters
+        // that could break out of a Turtle string literal
+        self::assertStringNotContainsString("\n", $escaped, "Unescaped newline in: {$description}");
+        self::assertStringNotContainsString("\r", $escaped, "Unescaped CR in: {$description}");
+
+        // Check quotes are escaped
+        if (str_contains($attack, '"')) {
+            self::assertStringContainsString('\\"', $escaped, "Quote not escaped in: {$description}");
+        }
+    }
+
+    /**
+     * @return array<string, array{string, string}>
+     */
+    public static function turtleInjectionVectorsProvider(): array
+    {
+        return [
+            'newline injection' => ["value\"\n<evil> <pred> <obj> .", 'newline triple injection'],
+            'quote breakout' => ['" . <evil> <pred> "', 'quote breakout attempt'],
+            'backslash confusion' => ['\\" . <evil>', 'backslash escape confusion'],
+            'null byte' => ["value\x00\"", 'null byte injection'],
+            'multiline' => ["line1\nline2\nline3", 'multiline injection'],
+        ];
+    }
+
+    // =========================================================================
+    // IRI Escaping (OWASP A03 - IRI Injection Prevention)
+    // =========================================================================
+
+    public function testIriEscapesDangerousChars(): void
+    {
+        self::assertSame('https://example.com/%3Cscript%3E', TurtleEscaper::iri('https://example.com/<script>'));
+        self::assertSame('https://example.com/%3E', TurtleEscaper::iri('https://example.com/>'));
+        self::assertSame('https://example.com/%22', TurtleEscaper::iri('https://example.com/"'));
+    }
+
+    public function testIriEscapesSpaces(): void
+    {
+        self::assertSame('https://example.com/path%20with%20spaces', TurtleEscaper::iri('https://example.com/path with spaces'));
+    }
+
+    public function testIriEscapesBraces(): void
+    {
+        self::assertSame('https://example.com/%7Bvalue%7D', TurtleEscaper::iri('https://example.com/{value}'));
+    }
+
+    public function testIriEscapesControlChars(): void
+    {
+        self::assertSame('https://example.com/%00', TurtleEscaper::iri("https://example.com/\x00"));
+        self::assertSame('https://example.com/%0A', TurtleEscaper::iri("https://example.com/\n"));
+    }
+
+    public function testIriPreservesValidUrl(): void
+    {
+        $url = 'https://example.com/path?query=value#fragment';
+        self::assertSame($url, TurtleEscaper::iri($url));
+    }
+
+    public function testIriRejectsInvalidWithDangerousChars(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Invalid IRI');
+
+        // Not a valid URL and contains dangerous chars
+        TurtleEscaper::iri('not-a-url<>');
+    }
+
+    public function testIriAcceptsRelativePaths(): void
+    {
+        // Relative paths without dangerous chars should work
+        self::assertSame('/path/to/resource', TurtleEscaper::iri('/path/to/resource'));
+        self::assertSame('#fragment', TurtleEscaper::iri('#fragment'));
+    }
+
+    // =========================================================================
+    // Language Tag Validation
+    // =========================================================================
+
+    public function testLanguageTagValid(): void
+    {
+        self::assertSame('en', TurtleEscaper::languageTag('en'));
+        self::assertSame('en-us', TurtleEscaper::languageTag('en-US'));
+        self::assertSame('de-de', TurtleEscaper::languageTag('de-DE'));
+        self::assertSame('zh-hans', TurtleEscaper::languageTag('zh-Hans'));
+        self::assertSame('pt-br', TurtleEscaper::languageTag('pt-BR'));
+    }
+
+    public function testLanguageTagNormalizesToLowercase(): void
+    {
+        self::assertSame('en-us', TurtleEscaper::languageTag('EN-US'));
+        self::assertSame('de', TurtleEscaper::languageTag('DE'));
+    }
+
+    public function testLanguageTagRejectsInvalid(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Invalid BCP 47 language tag');
+
+        TurtleEscaper::languageTag('not-a-valid-tag-12345');
+    }
+
+    #[DataProvider('invalidLanguageTagsProvider')]
+    public function testLanguageTagRejectsVariousInvalid(string $tag): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+
+        TurtleEscaper::languageTag($tag);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function invalidLanguageTagsProvider(): array
+    {
+        return [
+            'empty' => [''],
+            'single char' => ['e'],
+            'numbers only' => ['123'],
+            'special chars' => ['en<script>'],
+            'spaces' => ['en US'],
+            'too long segment' => ['en-abcdefghij'],
+        ];
+    }
+
+    // =========================================================================
+    // Literal Building
+    // =========================================================================
+
+    public function testLiteralPlain(): void
+    {
+        self::assertSame('"Hello World"', TurtleEscaper::literal('Hello World'));
+    }
+
+    public function testLiteralWithEscaping(): void
+    {
+        self::assertSame('"Hello \\"World\\""', TurtleEscaper::literal('Hello "World"'));
+        self::assertSame('"Line 1\\nLine 2"', TurtleEscaper::literal("Line 1\nLine 2"));
+    }
+
+    public function testLiteralWithLanguageTag(): void
+    {
+        self::assertSame('"Hello"@en', TurtleEscaper::literal('Hello', 'en'));
+        self::assertSame('"Bonjour"@fr', TurtleEscaper::literal('Bonjour', 'fr'));
+        self::assertSame('"Hallo"@de-de', TurtleEscaper::literal('Hallo', 'de-DE'));
+    }
+
+    public function testLiteralWithXsdDatatype(): void
+    {
+        $xsdString = 'http://www.w3.org/2001/XMLSchema#string';
+        self::assertSame('"test"^^xsd:string', TurtleEscaper::literal('test', null, $xsdString));
+
+        $xsdInteger = 'http://www.w3.org/2001/XMLSchema#integer';
+        self::assertSame('"42"^^xsd:integer', TurtleEscaper::literal('42', null, $xsdInteger));
+
+        $xsdDate = 'http://www.w3.org/2001/XMLSchema#date';
+        self::assertSame('"2024-01-15"^^xsd:date', TurtleEscaper::literal('2024-01-15', null, $xsdDate));
+    }
+
+    public function testLiteralWithCustomDatatype(): void
+    {
+        $customType = 'https://example.org/types#custom';
+        self::assertSame('"value"^^<https://example.org/types#custom>', TurtleEscaper::literal('value', null, $customType));
+    }
+
+    public function testLiteralLanguageHasPrecedence(): void
+    {
+        // When both language and datatype are provided, language wins
+        $result = TurtleEscaper::literal('Hello', 'en', 'http://www.w3.org/2001/XMLSchema#string');
+        self::assertSame('"Hello"@en', $result);
+    }
+
+    // =========================================================================
+    // Triple Building
+    // =========================================================================
+
+    public function testTripleBasic(): void
+    {
+        $result = TurtleEscaper::triple(
+            'https://example.org/subject',
+            'https://example.org/predicate',
+            'Object Value'
+        );
+
+        self::assertSame(
+            '<https://example.org/subject> <https://example.org/predicate> "Object Value" .',
+            $result
+        );
+    }
+
+    public function testTripleWithLanguage(): void
+    {
+        $result = TurtleEscaper::triple(
+            'https://example.org/subject',
+            'http://www.w3.org/2000/01/rdf-schema#label',
+            'A Label',
+            'en'
+        );
+
+        self::assertSame(
+            '<https://example.org/subject> <http://www.w3.org/2000/01/rdf-schema#label> "A Label"@en .',
+            $result
+        );
+    }
+
+    public function testTripleEscapesAll(): void
+    {
+        $result = TurtleEscaper::triple(
+            'https://example.org/subject',
+            'https://example.org/predicate',
+            'Value with "quotes" and newlines' . "\n"
+        );
+
+        self::assertStringContainsString('\\"quotes\\"', $result);
+        self::assertStringContainsString('\\n', $result);
+    }
+
+    // =========================================================================
+    // Triple IRI Building
+    // =========================================================================
+
+    public function testTripleIri(): void
+    {
+        $result = TurtleEscaper::tripleIri(
+            'https://example.org/subject',
+            'http://www.w3.org/1999/02/22-rdf-syntax-ns#type',
+            'https://example.org/Class'
+        );
+
+        self::assertSame(
+            '<https://example.org/subject> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://example.org/Class> .',
+            $result
+        );
+    }
+
+    public function testTripleIriEscapesAll(): void
+    {
+        // All three IRIs should be properly escaped
+        $result = TurtleEscaper::tripleIri(
+            'https://example.org/subject with spaces',
+            'https://example.org/predicate',
+            'https://example.org/object'
+        );
+
+        self::assertStringContainsString('%20', $result);
+    }
+
+    // =========================================================================
+    // Edge Cases and Security
+    // =========================================================================
+
+    public function testComplexInjectionPrevention(): void
+    {
+        // Attempt to inject a malicious triple via literal value
+        $maliciousValue = "\" .\n<https://evil.org> <https://evil.org/pred> <https://evil.org/obj>";
+
+        $result = TurtleEscaper::literal($maliciousValue);
+
+        // The result should be a single escaped string, not multiple triples
+        self::assertStringStartsWith('"', $result);
+        self::assertStringEndsWith('"', $result);
+
+        // Count quotes - should only have opening and closing
+        // All internal quotes should be escaped
+        self::assertStringContainsString('\\"', $result);
+        self::assertStringContainsString('\\n', $result);
+    }
+
+    public function testIriBreakoutPrevention(): void
+    {
+        // Attempt to break out of IRI context
+        $maliciousIri = 'https://example.org> <https://evil.org';
+
+        $escaped = TurtleEscaper::iri($maliciousIri);
+
+        // > should be percent-encoded
+        self::assertStringContainsString('%3E', $escaped);
+        self::assertStringContainsString('%3C', $escaped);
+    }
+
+    public function testLiteralWithAllSpecialChars(): void
+    {
+        $input = "\t\b\n\r\f\\\"'";
+        $result = TurtleEscaper::literal($input);
+
+        self::assertSame('"\\t\\b\\n\\r\\f\\\\\\"\\\'\"', $result);
+    }
+
+    public function testEmptyValues(): void
+    {
+        self::assertSame('""', TurtleEscaper::literal(''));
+        self::assertSame('""@en', TurtleEscaper::literal('', 'en'));
+    }
+
+    public function testVeryLongStrings(): void
+    {
+        $longString = str_repeat('a', 100000);
+        $result = TurtleEscaper::string($longString);
+
+        // Should not truncate
+        self::assertSame($longString, $result);
+    }
+}
diff --git a/tests/ValidatorTest.php b/tests/ValidatorTest.php
new file mode 100644
index 0000000..020ab90
--- /dev/null
+++ b/tests/ValidatorTest.php
@@ -0,0 +1,496 @@
+<?php
+
+/**
+ * SPDX-License-Identifier: MIT OR AGPL-3.0-or-later
+ * SPDX-FileCopyrightText: 2024-2025 Hyperpolymath
+ */
+
+declare(strict_types=1);
+
+namespace PhpAegis\Tests;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use PhpAegis\Validator;
+
+#[CoversClass(Validator::class)]
+final class ValidatorTest extends TestCase
+{
+    // =========================================================================
+    // Email Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    #[DataProvider('validEmailsProvider')]
+    public function testValidEmails(string $email): void
+    {
+        self::assertTrue(Validator::email($email), "Expected '{$email}' to be valid");
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validEmailsProvider(): array
+    {
+        return [
+            'simple' => ['user@example.com'],
+            'with subdomain' => ['user@mail.example.com'],
+            'with plus' => ['user+tag@example.com'],
+            'with dots' => ['first.last@example.com'],
+            'with numbers' => ['user123@example.com'],
+            'short domain' => ['a@b.co'],
+        ];
+    }
+
+    #[DataProvider('invalidEmailsProvider')]
+    public function testInvalidEmails(string $email): void
+    {
+        self::assertFalse(Validator::email($email), "Expected '{$email}' to be invalid");
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function invalidEmailsProvider(): array
+    {
+        return [
+            'empty' => [''],
+            'no at' => ['userexample.com'],
+            'no domain' => ['user@'],
+            'no local' => ['@example.com'],
+            'spaces' => ['user @example.com'],
+            'double at' => ['user@@example.com'],
+            'xss attempt' => ['user<script>@example.com'],
+            'sql injection' => ["user'; DROP TABLE--@example.com"],
+        ];
+    }
+
+    // =========================================================================
+    // URL Validation (OWASP A03, A10 - Injection, SSRF Prevention)
+    // =========================================================================
+
+    #[DataProvider('validUrlsProvider')]
+    public function testValidUrls(string $url): void
+    {
+        self::assertTrue(Validator::url($url), "Expected '{$url}' to be valid");
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function validUrlsProvider(): array
+    {
+        return [
+            'http' => ['http://example.com'],
+            'https' => ['https://example.com'],
+            'with path' => ['https://example.com/path/to/resource'],
+            'with query' => ['https://example.com?query=value'],
+            'with port' => ['https://example.com:8080'],
+            'with fragment' => ['https://example.com#section'],
+            'ip address' => ['http://192.168.1.1'],
+            'localhost' => ['http://localhost'],
+        ];
+    }
+
+    #[DataProvider('invalidUrlsProvider')]
+    public function testInvalidUrls(string $url): void
+    {
+        self::assertFalse(Validator::url($url), "Expected '{$url}' to be invalid");
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function invalidUrlsProvider(): array
+    {
+        return [
+            'empty' => [''],
+            'no scheme' => ['example.com'],
+            'javascript' => ['javascript:alert(1)'],
+            'data uri' => ['data:text/html,<script>'],
+            'file scheme' => ['file:///etc/passwd'],
+            'malformed' => ['http://'],
+        ];
+    }
+
+    // =========================================================================
+    // HTTPS URL Validation (OWASP A02 - Cryptographic Failures)
+    // =========================================================================
+
+    public function testHttpsUrlValid(): void
+    {
+        self::assertTrue(Validator::httpsUrl('https://example.com'));
+        self::assertTrue(Validator::httpsUrl('https://example.com/path'));
+        self::assertTrue(Validator::httpsUrl('https://sub.example.com:8443'));
+    }
+
+    public function testHttpsUrlRejectsHttp(): void
+    {
+        self::assertFalse(Validator::httpsUrl('http://example.com'));
+        self::assertFalse(Validator::httpsUrl('http://localhost'));
+    }
+
+    public function testHttpsUrlRejectsInvalid(): void
+    {
+        self::assertFalse(Validator::httpsUrl(''));
+        self::assertFalse(Validator::httpsUrl('ftp://example.com'));
+        self::assertFalse(Validator::httpsUrl('javascript:alert(1)'));
+    }
+
+    // =========================================================================
+    // IP Address Validation (OWASP A10 - SSRF Prevention)
+    // =========================================================================
+
+    public function testValidIpv4(): void
+    {
+        self::assertTrue(Validator::ipv4('192.168.1.1'));
+        self::assertTrue(Validator::ipv4('10.0.0.1'));
+        self::assertTrue(Validator::ipv4('8.8.8.8'));
+        self::assertTrue(Validator::ipv4('0.0.0.0'));
+        self::assertTrue(Validator::ipv4('255.255.255.255'));
+    }
+
+    public function testInvalidIpv4(): void
+    {
+        self::assertFalse(Validator::ipv4(''));
+        self::assertFalse(Validator::ipv4('256.1.1.1'));
+        self::assertFalse(Validator::ipv4('1.2.3'));
+        self::assertFalse(Validator::ipv4('1.2.3.4.5'));
+        self::assertFalse(Validator::ipv4('::1'));
+        self::assertFalse(Validator::ipv4('not-an-ip'));
+    }
+
+    public function testValidIpv6(): void
+    {
+        self::assertTrue(Validator::ipv6('::1'));
+        self::assertTrue(Validator::ipv6('2001:db8::1'));
+        self::assertTrue(Validator::ipv6('fe80::1'));
+        self::assertTrue(Validator::ipv6('::ffff:192.168.1.1'));
+    }
+
+    public function testInvalidIpv6(): void
+    {
+        self::assertFalse(Validator::ipv6(''));
+        self::assertFalse(Validator::ipv6('192.168.1.1'));
+        self::assertFalse(Validator::ipv6('not-an-ip'));
+        self::assertFalse(Validator::ipv6('::gggg'));
+    }
+
+    public function testIpAcceptsBoth(): void
+    {
+        self::assertTrue(Validator::ip('192.168.1.1'));
+        self::assertTrue(Validator::ip('::1'));
+        self::assertFalse(Validator::ip('not-an-ip'));
+    }
+
+    // =========================================================================
+    // UUID Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testValidUuids(): void
+    {
+        self::assertTrue(Validator::uuid('550e8400-e29b-41d4-a716-446655440000'));
+        self::assertTrue(Validator::uuid('6ba7b810-9dad-11d1-80b4-00c04fd430c8'));
+        self::assertTrue(Validator::uuid('f47ac10b-58cc-4372-a567-0e02b2c3d479'));
+        // Case insensitive
+        self::assertTrue(Validator::uuid('550E8400-E29B-41D4-A716-446655440000'));
+    }
+
+    public function testInvalidUuids(): void
+    {
+        self::assertFalse(Validator::uuid(''));
+        self::assertFalse(Validator::uuid('not-a-uuid'));
+        self::assertFalse(Validator::uuid('550e8400-e29b-41d4-a716')); // Too short
+        self::assertFalse(Validator::uuid('550e8400e29b41d4a716446655440000')); // No dashes
+        self::assertFalse(Validator::uuid('550e8400-e29b-61d4-a716-446655440000')); // Invalid version
+        self::assertFalse(Validator::uuid("550e8400-e29b-41d4-a716-44665544000\x00")); // Null byte
+    }
+
+    // =========================================================================
+    // Slug Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testValidSlugs(): void
+    {
+        self::assertTrue(Validator::slug('hello-world'));
+        self::assertTrue(Validator::slug('my-page'));
+        self::assertTrue(Validator::slug('page123'));
+        self::assertTrue(Validator::slug('a'));
+        self::assertTrue(Validator::slug('123'));
+    }
+
+    public function testInvalidSlugs(): void
+    {
+        self::assertFalse(Validator::slug(''));
+        self::assertFalse(Validator::slug('Hello-World')); // Uppercase
+        self::assertFalse(Validator::slug('-hello')); // Leading dash
+        self::assertFalse(Validator::slug('hello-')); // Trailing dash
+        self::assertFalse(Validator::slug('hello--world')); // Double dash
+        self::assertFalse(Validator::slug('hello world')); // Space
+        self::assertFalse(Validator::slug('hello_world')); // Underscore
+        self::assertFalse(Validator::slug('../etc/passwd')); // Path traversal
+    }
+
+    // =========================================================================
+    // Null Byte Validation (OWASP A03 - Path Traversal Prevention)
+    // =========================================================================
+
+    public function testNoNullBytes(): void
+    {
+        self::assertTrue(Validator::noNullBytes('normal string'));
+        self::assertTrue(Validator::noNullBytes(''));
+        self::assertTrue(Validator::noNullBytes('path/to/file.txt'));
+    }
+
+    public function testDetectsNullBytes(): void
+    {
+        self::assertFalse(Validator::noNullBytes("file.php\x00.jpg"));
+        self::assertFalse(Validator::noNullBytes("\x00hidden"));
+        self::assertFalse(Validator::noNullBytes("evil\x00payload"));
+    }
+
+    // =========================================================================
+    // Safe Filename Validation (OWASP A03 - Path Traversal Prevention)
+    // =========================================================================
+
+    public function testSafeFilenames(): void
+    {
+        self::assertTrue(Validator::safeFilename('document.pdf'));
+        self::assertTrue(Validator::safeFilename('image.jpg'));
+        self::assertTrue(Validator::safeFilename('my-file_123.txt'));
+        self::assertTrue(Validator::safeFilename('UPPERCASE.PDF'));
+    }
+
+    #[DataProvider('unsafeFilenamesProvider')]
+    public function testUnsafeFilenames(string $filename, string $reason): void
+    {
+        self::assertFalse(
+            Validator::safeFilename($filename),
+            "Expected '{$filename}' to be unsafe: {$reason}"
+        );
+    }
+
+    /**
+     * @return array<string, array{string, string}>
+     */
+    public static function unsafeFilenamesProvider(): array
+    {
+        return [
+            'path traversal unix' => ['../etc/passwd', 'path traversal'],
+            'path traversal windows' => ['..\\windows\\system32', 'path traversal'],
+            'absolute unix' => ['/etc/passwd', 'absolute path'],
+            'absolute windows' => ['C:\\Windows', 'absolute path'],
+            'null byte' => ["file.php\x00.jpg", 'null byte injection'],
+            'hidden file' => ['.htaccess', 'hidden file'],
+            'dot' => ['.', 'current directory'],
+            'dotdot' => ['..', 'parent directory'],
+            'empty' => ['', 'empty not allowed - but this might pass safeFilename'],
+        ];
+    }
+
+    // =========================================================================
+    // JSON Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testValidJson(): void
+    {
+        self::assertTrue(Validator::json('{}'));
+        self::assertTrue(Validator::json('[]'));
+        self::assertTrue(Validator::json('{"key": "value"}'));
+        self::assertTrue(Validator::json('[1, 2, 3]'));
+        self::assertTrue(Validator::json('"string"'));
+        self::assertTrue(Validator::json('123'));
+        self::assertTrue(Validator::json('true'));
+        self::assertTrue(Validator::json('null'));
+    }
+
+    public function testInvalidJson(): void
+    {
+        self::assertFalse(Validator::json(''));
+        self::assertFalse(Validator::json('{invalid}'));
+        self::assertFalse(Validator::json("{'single': 'quotes'}"));
+        self::assertFalse(Validator::json('{key: "no quotes"}'));
+        self::assertFalse(Validator::json('[1, 2, 3,]')); // Trailing comma
+    }
+
+    // =========================================================================
+    // Integer Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testValidIntegers(): void
+    {
+        self::assertTrue(Validator::int('0'));
+        self::assertTrue(Validator::int('123'));
+        self::assertTrue(Validator::int('-456'));
+        self::assertTrue(Validator::int('999999999'));
+    }
+
+    public function testInvalidIntegers(): void
+    {
+        self::assertFalse(Validator::int(''));
+        self::assertFalse(Validator::int('12.34'));
+        self::assertFalse(Validator::int('abc'));
+        self::assertFalse(Validator::int('12abc'));
+        self::assertFalse(Validator::int('1.0'));
+    }
+
+    public function testIntegerWithRange(): void
+    {
+        self::assertTrue(Validator::int('5', 1, 10));
+        self::assertTrue(Validator::int('1', 1, 10));
+        self::assertTrue(Validator::int('10', 1, 10));
+
+        self::assertFalse(Validator::int('0', 1, 10));
+        self::assertFalse(Validator::int('11', 1, 10));
+        self::assertFalse(Validator::int('-1', 0, 100));
+    }
+
+    public function testIntegerWithMinOnly(): void
+    {
+        self::assertTrue(Validator::int('100', 0));
+        self::assertTrue(Validator::int('0', 0));
+        self::assertFalse(Validator::int('-1', 0));
+    }
+
+    public function testIntegerWithMaxOnly(): void
+    {
+        self::assertTrue(Validator::int('50', null, 100));
+        self::assertTrue(Validator::int('100', null, 100));
+        self::assertFalse(Validator::int('101', null, 100));
+    }
+
+    // =========================================================================
+    // Domain Validation (OWASP A10 - SSRF Prevention)
+    // =========================================================================
+
+    public function testValidDomains(): void
+    {
+        self::assertTrue(Validator::domain('example.com'));
+        self::assertTrue(Validator::domain('sub.example.com'));
+        self::assertTrue(Validator::domain('my-site.co.uk'));
+        self::assertTrue(Validator::domain('a.io'));
+    }
+
+    public function testInvalidDomains(): void
+    {
+        self::assertFalse(Validator::domain(''));
+        self::assertFalse(Validator::domain('-example.com')); // Leading hyphen
+        self::assertFalse(Validator::domain('example-.com')); // Trailing hyphen
+        self::assertFalse(Validator::domain('example')); // No TLD
+        self::assertFalse(Validator::domain('.com')); // No domain
+        self::assertFalse(Validator::domain('exam ple.com')); // Space
+        self::assertFalse(Validator::domain('example..com')); // Double dot
+        self::assertFalse(Validator::domain(str_repeat('a', 254) . '.com')); // Too long
+    }
+
+    // =========================================================================
+    // Hostname Validation (OWASP A10 - SSRF Prevention)
+    // =========================================================================
+
+    public function testValidHostnames(): void
+    {
+        // Domains
+        self::assertTrue(Validator::hostname('example.com'));
+        // IPv4
+        self::assertTrue(Validator::hostname('192.168.1.1'));
+        // IPv6
+        self::assertTrue(Validator::hostname('::1'));
+    }
+
+    public function testInvalidHostnames(): void
+    {
+        self::assertFalse(Validator::hostname(''));
+        self::assertFalse(Validator::hostname('not a host'));
+    }
+
+    // =========================================================================
+    // Printable Validation (OWASP A03 - Injection Prevention)
+    // =========================================================================
+
+    public function testPrintableStrings(): void
+    {
+        self::assertTrue(Validator::printable('Hello World!'));
+        self::assertTrue(Validator::printable('Special chars: @#$%^&*()'));
+        self::assertTrue(Validator::printable(''));
+        self::assertTrue(Validator::printable(' ')); // Space is printable
+    }
+
+    public function testNonPrintableStrings(): void
+    {
+        self::assertFalse(Validator::printable("Hello\x00World")); // Null byte
+        self::assertFalse(Validator::printable("Hello\nWorld")); // Newline
+        self::assertFalse(Validator::printable("Hello\tWorld")); // Tab
+        self::assertFalse(Validator::printable("\x1B[31mRed\x1B[0m")); // ANSI escape
+        self::assertFalse(Validator::printable("Hello\x7FWorld")); // DEL character
+    }
+
+    // =========================================================================
+    // Semver Validation
+    // =========================================================================
+
+    public function testValidSemver(): void
+    {
+        self::assertTrue(Validator::semver('1.0.0'));
+        self::assertTrue(Validator::semver('0.0.1'));
+        self::assertTrue(Validator::semver('10.20.30'));
+        self::assertTrue(Validator::semver('1.0.0-alpha'));
+        self::assertTrue(Validator::semver('1.0.0-alpha.1'));
+        self::assertTrue(Validator::semver('1.0.0+build'));
+        self::assertTrue(Validator::semver('1.0.0-beta+build.123'));
+    }
+
+    public function testInvalidSemver(): void
+    {
+        self::assertFalse(Validator::semver(''));
+        self::assertFalse(Validator::semver('1.0'));
+        self::assertFalse(Validator::semver('v1.0.0')); // No 'v' prefix
+        self::assertFalse(Validator::semver('1.0.0.0'));
+        self::assertFalse(Validator::semver('01.0.0')); // Leading zero
+    }
+
+    // =========================================================================
+    // ISO 8601 Date Validation
+    // =========================================================================
+
+    public function testValidIso8601(): void
+    {
+        self::assertTrue(Validator::iso8601('2024-01-15'));
+        self::assertTrue(Validator::iso8601('2024-01-15T10:30:00'));
+        self::assertTrue(Validator::iso8601('2024-01-15T10:30:00Z'));
+        self::assertTrue(Validator::iso8601('2024-01-15T10:30:00+00:00'));
+    }
+
+    public function testInvalidIso8601(): void
+    {
+        self::assertFalse(Validator::iso8601(''));
+        self::assertFalse(Validator::iso8601('2024/01/15'));
+        self::assertFalse(Validator::iso8601('01-15-2024'));
+        self::assertFalse(Validator::iso8601('not a date'));
+        self::assertFalse(Validator::iso8601('2024-13-01')); // Invalid month
+        self::assertFalse(Validator::iso8601('2024-01-32')); // Invalid day
+    }
+
+    // =========================================================================
+    // Hex Color Validation
+    // =========================================================================
+
+    public function testValidHexColors(): void
+    {
+        self::assertTrue(Validator::hexColor('#fff'));
+        self::assertTrue(Validator::hexColor('#FFF'));
+        self::assertTrue(Validator::hexColor('#ffffff'));
+        self::assertTrue(Validator::hexColor('#FFFFFF'));
+        self::assertTrue(Validator::hexColor('#000'));
+        self::assertTrue(Validator::hexColor('#123456'));
+    }
+
+    public function testInvalidHexColors(): void
+    {
+        self::assertFalse(Validator::hexColor(''));
+        self::assertFalse(Validator::hexColor('fff')); // Missing #
+        self::assertFalse(Validator::hexColor('#ff')); // Too short
+        self::assertFalse(Validator::hexColor('#ffff')); // Wrong length
+        self::assertFalse(Validator::hexColor('#gggggg')); // Invalid chars
+        self::assertFalse(Validator::hexColor('red')); // Named color
+    }
+}