checklist
10 articles
-
File Upload Testing Checklist: Types, Size, Security and UX
File upload is one of the most under-tested and most dangerous inputs: you accept a stranger's file onto your server. We cover types and MIME, size, filenames, security (MIME spoofing, path traversal, SVG-XSS, EXIF), processing, UX and storage — with a summary checklist and tools.
-
A Checklist for Testing Dates, Time and Time Zones
Dates are a source of bugs that surface in production six months later. A practical checklist: storing in UTC, time zones, daylight saving (DST), date formats, boundaries (midnight, end of month, Feb 29), calculations across DST, relative time, and how to reproduce it all.
-
Testing Money and Numbers: A 35-Point Checklist of Where It All Breaks
0.1 + 0.2 ≠ 0.3 — and that's just the start. Money and numbers are a minefield: float error, rounding, locales, currencies, boundary values. A first-person take: why money isn't stored in float, rounding and splitting an amount, locale formatting, currency decimal places, user input, and the business logic of discounts and taxes. With a flat checklist.
-
Transactional Email Testing Checklist: 40 Things People Forget
"It's just an email" — and then the password reset lands in spam, the welcome mail proudly reads "Hello, {{name}}", and the link expires before it even arrives. A first-person take: trigger and content, deliverability (SPF/DKIM/DMARC, spam), links and tokens, rendering in email clients (dark mode, images off, Gmail/Outlook), timing/duplicates/retries, localization and unsubscribe. With a flat checklist.
-
Payment & checkout testing checklist — the cases where money breaks
Checkout is where money and trust meet, yet it's usually tested with card 4242 and the happy path. A first-person take: money as integer minor units, not floats; double charges and idempotency; bank declines as normal, not a 500; 3-D Secure and the abandoned challenge; the webhook as source of truth, not the redirect; recomputing totals and promo codes on the server; PCI and tokenization; network drops at every step. Plus a flat 16-point checklist.
-
Registration & login testing checklist — with a Playwright autotest for every item
Login is the first screen a user sees and a favorite spot for production incidents. The "checklist item → how to automate it" format: user enumeration via identical error messages, password reset with a single-use token, logout and the back button, HttpOnly/Secure cookies via context.cookies(), sessions across two tabs, mocking 429 for lockout UI, the storageState pattern so you don't log in inside every test — and what parts of auth should never go into e2e.
-
Screen states: empty, loading, error — and the ones people forget until a bug arrives
Screens get designed for the happy path, but the user sees loading, emptiness or an error first. A first-person walkthrough: the empty screen that looks like a stuck loader; why 'nothing here yet' and 'nothing found' are different empties; why an error must not look like emptiness; offline, partial load, stale data, errors on load-more; accessibility of empty and error states, plus a compact checklist.
-
Search and filters testing checklist — and how to automate every item with Playwright
Search and filters are almost everywhere, and the bugs are always the same. A checklist of what to test (edge-case queries, debounce, request races, empty state, XSS, filters in the URL, resilience to backend errors, localization) — and for each item a real Playwright test via network interception with page.route. Plus what NOT to automate in e2e.
-
File upload testing checklist: 30+ cases people forget
A reusable file upload testing checklist: content vs extension and magic bytes, sizes and decompression bombs, file names and path traversal, the upload process and dropped connections, server-side processing and storage, security (SVG XSS, RCE, SSRF) and accessibility. 30+ points.
-
Form testing checklist: 30+ cases people forget
A reusable form testing checklist: text fields and trimming, validation, numbers and money, email/phone/date/password, masks and autofill, double submit and idempotency, network, security and error accessibility. 30 points + a mini template.