The 12 API bugs I check for first
A high-value checklist: the twelve API bugs that surface most often, from wrong status codes to idempotency failures.
A high-value checklist: the twelve API bugs that surface most often, from wrong status codes to idempotency failures.
A ten-minute accessibility pass any QA can run before release — keyboard, focus, contrast, and the obvious screen-reader checks.
A sign-off checklist short enough that people actually use it — and specific enough to catch the things that block releases.
A short, device-real smoke pass: permissions, offline, rotation, interruptions, and the update path.
The OWASP Top 10 translated for QA: what each category means for flows you already test, and the one check you can run without being a pentester.
The full multi-factor auth test surface: bypass, wrong/expired/reused codes, brute-force lockout, recovery, and the usability cases most teams skip.
Not a full load test — a fast, fixed, repeatable check on a few critical endpoints, compared to baseline, that catches gross regressions before sign-off.
A 30-second readiness check before accepting a ticket into QA — testable criteria, defined edge cases, reachable build, known data — that replaces a day of back-and-forth.