diff --git a/fixtures/test-list-files-not-exposed/config.toml b/fixtures/test-list-files-not-exposed/config.toml
new file mode 100644
index 00000000..3766b546
--- /dev/null
+++ b/fixtures/test-list-files-not-exposed/config.toml
@@ -0,0 +1,10 @@
+[server]
+address = "127.0.0.1:8000"
+max_content_length = "10MB"
+upload_path = "./upload"
+expose_list = false
+
+[paste]
+random_url = { type = "petname", words = 2, separator = "-" }
+default_extension = "txt"
+duplicate_files = true
diff --git a/fixtures/test-list-files-not-exposed/test.sh b/fixtures/test-list-files-not-exposed/test.sh
new file mode 100755
index 00000000..cd3735bd
--- /dev/null
+++ b/fixtures/test-list-files-not-exposed/test.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+setup() {
+  echo "$content" > file
+}
+
+run_test() {
+  result=$(curl -s --write-out "%{http_code}" http://localhost:8000/list)
+  test "404" = "$result"
+}
+
+teardown() {
+  rm file
+  rm -r upload
+}
diff --git a/fixtures/test-server-auth-tokens-unset/config.toml b/fixtures/test-server-auth-tokens-unset/config.toml
new file mode 100644
index 00000000..13838f84
--- /dev/null
+++ b/fixtures/test-server-auth-tokens-unset/config.toml
@@ -0,0 +1,8 @@
+[server]
+address = "127.0.0.1:8000"
+max_content_length = "10MB"
+upload_path = "./upload"
+
+[paste]
+default_extension = "txt"
+duplicate_files = false
diff --git a/fixtures/test-server-auth-tokens-unset/test.sh b/fixtures/test-server-auth-tokens-unset/test.sh
new file mode 100755
index 00000000..77b03077
--- /dev/null
+++ b/fixtures/test-server-auth-tokens-unset/test.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+content="test data"
+
+setup() {
+  echo "$content" > file
+}
+
+run_test() {
+  file_url=$(curl -s -F "file=@file" localhost:8000)
+  test "$file_url" = "http://localhost:8000/file.txt"
+
+  result=$(curl -s --write-out "%{http_code}" -X DELETE http://localhost:8000/file.txt)
+  test "404" = "$result"
+}
+
+teardown() {
+  rm file
+  rm -r upload
+}
diff --git a/fixtures/test-server-delete-tokens-unset/config.toml b/fixtures/test-server-delete-tokens-unset/config.toml
new file mode 100644
index 00000000..13838f84
--- /dev/null
+++ b/fixtures/test-server-delete-tokens-unset/config.toml
@@ -0,0 +1,8 @@
+[server]
+address = "127.0.0.1:8000"
+max_content_length = "10MB"
+upload_path = "./upload"
+
+[paste]
+default_extension = "txt"
+duplicate_files = false
diff --git a/fixtures/test-server-delete-tokens-unset/test.sh b/fixtures/test-server-delete-tokens-unset/test.sh
new file mode 100755
index 00000000..2c0a7454
--- /dev/null
+++ b/fixtures/test-server-delete-tokens-unset/test.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+content="topsecret"
+
+setup() {
+  echo "$content" > file
+}
+
+run_test() {
+  result=$(curl -s -F "file=@file" localhost:8000)
+  test "unauthorized" != "$result"
+  test "$content" = "$(cat upload/file.txt)"
+  test "$content" = "$(curl -s $result)"
+}
+
+teardown() {
+  rm file
+  rm -r upload
+}
diff --git a/fixtures/test-version-not-exposed/config.toml b/fixtures/test-version-not-exposed/config.toml
new file mode 100644
index 00000000..f833e890
--- /dev/null
+++ b/fixtures/test-version-not-exposed/config.toml
@@ -0,0 +1,10 @@
+[server]
+address = "127.0.0.1:8000"
+max_content_length = "10MB"
+upload_path = "./upload"
+expose_version = false
+
+[paste]
+random_url = { type = "petname", words = 2, separator = "-" }
+default_extension = "txt"
+duplicate_files = true
diff --git a/fixtures/test-version-not-exposed/test.sh b/fixtures/test-version-not-exposed/test.sh
new file mode 100755
index 00000000..073fbfb6
--- /dev/null
+++ b/fixtures/test-version-not-exposed/test.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+setup() {
+  echo "$content" > file
+}
+
+run_test() {
+  result=$(curl -s --write-out "%{http_code}" http://localhost:8000/version)
+  test "404" = "$result"
+}
+
+teardown() {
+  rm file
+  rm -r upload
+}