Bug Hunting
Exploratory testing uses the product as a person would. This skill abuses it
on purpose, in a fixed order, so that the defects everyone knows exist are
found deliberately rather than by luck in production.
A feature that only survives being used correctly is not finished.
1. Entry condition
The happy path passes. Hunting a broken feature wastes the pass: everything
fails and nothing is learned. Fix the happy path first, then hunt.
2. The matrix
Nine families. Each is run against the feature under test, and each result is
recorded, including the ones that behave correctly. The expanded version, with
the exact moves per family, is in resources/hunt-matrix.md.
| Family |
The abuse |
The defect it exposes |
| repetition |
the same action twice, three times, fast |
missing idempotency, duplicate records, duplicate mail or charge |
| concurrency |
two tabs, two requests, the same instant |
lost update, race, unique constraint surfacing as a crash |
| interruption |
reload, back, forward, close, escape, mid operation |
orphaned state, lost work, half completed writes |
| session |
expired, revoked, logged out elsewhere, changed role |
silent failure, action accepted after revocation, stale permission |
| network |
slow, offline, timeout, failed, retried |
spinners that never end, false success, retries that duplicate |
| response |
empty, partial, unexpected shape, error body, wrong type |
crashes on render, silent blank screens, undefined in the interface |
| input |
empty, boundary, one beyond, oversized, unusual characters |
truncation, client-only validation, layout breakage, 500 responses |
| sequence |
steps out of order, skipped step, resumed old link |
state machines that accept impossible transitions |
| environment |
viewport change, zoom, language, timezone, back-dated clock |
layout collapse, off by one day, wrong currency or format |
3. Order
Run the families in the order above. Repetition and concurrency are first
because they are the cheapest to run and the most likely to produce a defect
that matters. Environment is last because its findings are usually cosmetic
and would otherwise consume the session.
4. Boundaries and input
Input abuse is a controlled test of validation, not an attack. Use the safe
catalogue in resources/boundary-inputs.md: empty, minimum, maximum, maximum
plus one, whitespace only, very long, unusual scripts, control characters,
numeric extremes, malformed dates.
Payload shapes designed to exploit rather than to probe belong to
security-testing, under the authorisation of the testing contract. The line
is intent: here the question is whether invalid input is rejected safely, not
whether a boundary can be crossed.
5. What is a defect
Not every surprise is one. Before recording, decide:
requirement does a stated requirement or an obvious convention say otherwise
consequence what does it cost the user, the data, or the business
reproducible from a clean state, how many times out of how many
scope only here, or everywhere the same pattern is used
A behaviour that is deliberate, documented and harmless is recorded as
by design with the reference, so the next hunt does not rediscover it.
6. Minimal reproduction
A finding is not finished until it is small. Strip the session down to the
shortest sequence that still produces it:
starting state the fewest preconditions that still work
steps the fewest actions that still reproduce
frequency 3 of 3, or 2 of 5, stated as observed
evidence screenshot, console line, network entry, request identifier
scope which other features share the same code path
A five step reproduction gets fixed. A twenty step story gets closed as
unreproducible.
7. Prohibitions
- Never run a destructive scenario without explicit authorisation in the
testing contract.
- Never generate load against a shared or production environment. Volume
testing is
performance-engineering, and it is scheduled, not improvised.
- Never test authorization boundaries beyond the accounts and hosts the
contract names; that is
security-testing.
- Never report a hit without a minimal reproduction and a frequency.
- Never keep hunting a feature whose happy path is broken.
- Never fix while hunting. Record, finish the matrix, then fix.
- Never leave the environment holding junk that will confuse the next tester.
8. Protocol
- Confirm the happy path passes and the contract permits the families.
- Identify the feature's write operations, since they carry the risk.
- Establish a clean, known starting state.
- Run the nine families in order, recording every result.
- For each hit, produce the minimal reproduction from a clean state.
- Rank by consequence, not by how surprising the finding felt.
- Name the regression candidates: the hits that must become permanent tests.
- Clean up the data the session created.
- Hand the list to
test-reporting, the regression candidates to
testing-quality, and the root cause work to debugging.
9. Auto-critique
Score from 0 to 5: matrix completeness, order respected, quality of the
minimal reproductions, honesty about frequency, correct separation of defect
from by design, regression candidates identified, environment left clean.
Threshold: no axis below 3, average at least 4. A hunt that skipped repetition
or concurrency on a feature with write operations is not a hunt and is rerun.
10. Interfaces
- Upstream:
quality-engineering for the contract,
exploratory-testing for the areas worth hunting.
- Lateral:
security-testing for anything past a permission boundary,
reliability-testing for injected dependency failure,
input-validation for the adversarial input matrix on the server side.
- Downstream:
debugging for root cause, testing-quality for the permanent
tests, test-reporting for the defect list.
1---2name: bug-hunting3description: Bug Hunting4---56# Bug Hunting78Exploratory testing uses the product as a person would. This skill abuses it9on purpose, in a fixed order, so that the defects everyone knows exist are10found deliberately rather than by luck in production.1112A feature that only survives being used correctly is not finished.1314## 1. Entry condition1516The happy path passes. Hunting a broken feature wastes the pass: everything17fails and nothing is learned. Fix the happy path first, then hunt.1819## 2. The matrix2021Nine families. Each is run against the feature under test, and each result is22recorded, including the ones that behave correctly. The expanded version, with23the exact moves per family, is in `resources/hunt-matrix.md`.2425| Family | The abuse | The defect it exposes |26|---|---|---|27| repetition | the same action twice, three times, fast | missing idempotency, duplicate records, duplicate mail or charge |28| concurrency | two tabs, two requests, the same instant | lost update, race, unique constraint surfacing as a crash |29| interruption | reload, back, forward, close, escape, mid operation | orphaned state, lost work, half completed writes |30| session | expired, revoked, logged out elsewhere, changed role | silent failure, action accepted after revocation, stale permission |31| network | slow, offline, timeout, failed, retried | spinners that never end, false success, retries that duplicate |32| response | empty, partial, unexpected shape, error body, wrong type | crashes on render, silent blank screens, undefined in the interface |33| input | empty, boundary, one beyond, oversized, unusual characters | truncation, client-only validation, layout breakage, 500 responses |34| sequence | steps out of order, skipped step, resumed old link | state machines that accept impossible transitions |35| environment | viewport change, zoom, language, timezone, back-dated clock | layout collapse, off by one day, wrong currency or format |3637## 3. Order3839Run the families in the order above. Repetition and concurrency are first40because they are the cheapest to run and the most likely to produce a defect41that matters. Environment is last because its findings are usually cosmetic42and would otherwise consume the session.4344## 4. Boundaries and input4546Input abuse is a controlled test of validation, not an attack. Use the safe47catalogue in `resources/boundary-inputs.md`: empty, minimum, maximum, maximum48plus one, whitespace only, very long, unusual scripts, control characters,49numeric extremes, malformed dates.5051Payload shapes designed to exploit rather than to probe belong to52`security-testing`, under the authorisation of the testing contract. The line53is intent: here the question is whether invalid input is rejected safely, not54whether a boundary can be crossed.5556## 5. What is a defect5758Not every surprise is one. Before recording, decide:5960```61requirement does a stated requirement or an obvious convention say otherwise62consequence what does it cost the user, the data, or the business63reproducible from a clean state, how many times out of how many64scope only here, or everywhere the same pattern is used65```6667A behaviour that is deliberate, documented and harmless is recorded as68`by design` with the reference, so the next hunt does not rediscover it.6970## 6. Minimal reproduction7172A finding is not finished until it is small. Strip the session down to the73shortest sequence that still produces it:7475```76starting state the fewest preconditions that still work77steps the fewest actions that still reproduce78frequency 3 of 3, or 2 of 5, stated as observed79evidence screenshot, console line, network entry, request identifier80scope which other features share the same code path81```8283A five step reproduction gets fixed. A twenty step story gets closed as84unreproducible.8586## 7. Prohibitions8788- Never run a destructive scenario without explicit authorisation in the89 testing contract.90- Never generate load against a shared or production environment. Volume91 testing is `performance-engineering`, and it is scheduled, not improvised.92- Never test authorization boundaries beyond the accounts and hosts the93 contract names; that is `security-testing`.94- Never report a hit without a minimal reproduction and a frequency.95- Never keep hunting a feature whose happy path is broken.96- Never fix while hunting. Record, finish the matrix, then fix.97- Never leave the environment holding junk that will confuse the next tester.9899## 8. Protocol1001011. Confirm the happy path passes and the contract permits the families.1022. Identify the feature's write operations, since they carry the risk.1033. Establish a clean, known starting state.1044. Run the nine families in order, recording every result.1055. For each hit, produce the minimal reproduction from a clean state.1066. Rank by consequence, not by how surprising the finding felt.1077. Name the regression candidates: the hits that must become permanent tests.1088. Clean up the data the session created.1099. Hand the list to `test-reporting`, the regression candidates to110 `testing-quality`, and the root cause work to `debugging`.111112## 9. Auto-critique113114Score from 0 to 5: matrix completeness, order respected, quality of the115minimal reproductions, honesty about frequency, correct separation of defect116from `by design`, regression candidates identified, environment left clean.117118Threshold: no axis below 3, average at least 4. A hunt that skipped repetition119or concurrency on a feature with write operations is not a hunt and is rerun.120121## 10. Interfaces122123- Upstream: `quality-engineering` for the contract,124 `exploratory-testing` for the areas worth hunting.125- Lateral: `security-testing` for anything past a permission boundary,126 `reliability-testing` for injected dependency failure,127 `input-validation` for the adversarial input matrix on the server side.128- Downstream: `debugging` for root cause, `testing-quality` for the permanent129 tests, `test-reporting` for the defect list.
Handsomeboy990