19 posts
Blog
Four categories. Short posts. Every figure carries a source and the day we verified it.
- 2026-09-18
How to test AI-generated code before release
The same tests as any code, with a different starting list. The documented failure profile of AI-assisted code gives you ten categories and the order to run them in.
- 2026-09-16
QA as a service vs QA outsourcing
Both put testing outside the team. One sells time, the other sells a defined scope with a verdict. The difference shows in the contract, the report and what happens when you leave.
- 2026-09-14
What a release verdict says, and what it does not
A verdict is one word with findings behind it, signed by a person, naming the build and the checklist version. Here is what each word means and what none of them promises.
- 2026-09-12
What the measured samples say about AI-generated code
Five studies with stated samples, read for what a tester should do differently. Every figure links to the evidence page with its source, its verification date and, for percentages, the denominator.
- 2026-09-11
Playwright in your CI, not ours
The suite we write lives in your repository and runs in your pipeline. Here is how it is laid out, what a flow is, and why you keep it if you leave.
- 2026-09-10
Rehearse the rollback before you need it
A rollback plan that has not been run is a belief. Checklist item DR-02 turns it into a timed procedure, and the July 2025 database deletion shows why the difference matters.
- 2026-09-08
QA Wolf alternatives: what to compare before you compare vendors
Teams searching for a QA Wolf alternative are usually comparing three things at once, coverage model, pricing model and who owns the suite. Separate them and the choice gets easier.
- 2026-09-05
Weekly, daily, continuous: the same checklist at three cadences
The checklist does not shrink when releases speed up. What changes is which items run in CI, which a person runs, and how the plan limits describe the difference.
- 2026-09-03
A k6 performance smoke, and what a budget looks like
Growth and Scale run a smoke test under baseline load on every release. It is short, it has a written budget per flow, and it fails on a number, not an impression.
- 2026-09-02
Row-level security: the most documented failure on AI-built apps
A CVE, a platform-wide database exposure and the vendor's own going-live note all describe the same thing. Two checklist items catch it on every release.
- 2026-08-30
Managed QA vs test automation tools
A tool runs the tests you write. A managed service decides what to test, writes and maintains the suite, runs what cannot be automated, and signs a verdict. Both have a place.
- 2026-08-28
Holding a release on a critical finding
A fail verdict holds the release. Here is what happens in the hours after, what "critical" means on the checklist, and why the same-day re-test is usually possible.
- 2026-08-27
Testing Stripe webhooks with the CLI, including the cases that should fail
Forwarding events to a local endpoint is the easy half. The checklist's payment items send the events the docs warn about, unsigned, altered, duplicated and reversed.
- 2026-08-25
Secrets in the bundle: why it keeps happening
A key that reaches the browser is public. Three measured sources say it keeps happening, the framework docs say why, and one automated item catches it before release.
- 2026-08-22
The two-user test
The only proof that an access policy works is a foreign read that returns nothing. Here is the test, how to automate it per table, and why reading the policy is not enough.
- 2026-08-20
Release records that answer a security questionnaire
Enterprise questionnaires ask for a documented release procedure and evidence it runs. A release record with a checklist version, a verdict and a signature is that evidence.
- 2026-08-18
Coding agents and production credentials
Every agent's docs describe a mode where commands run without approval. The checklist's answer is not to forbid the mode; it is to make sure the shell it runs in cannot reach production.
- 2026-08-15
Pass criteria, not adjectives
A checklist item that says "secure" or "properly handled" cannot be failed. Every item on ours states the observable result that counts, so two testers reach the same verdict.
- 2026-08-12
Golden sets: regression testing for an LLM feature
A model or prompt change shifts outputs across the product. A golden set of inputs with recorded expectations is how you see the shift before users do. Checklist item LM-05.