We keep a log of where defects were actually found, and it is boringly consistent year to year. If you have limited testing time, spend it here.
The list
- The second page. Pagination plus filtering plus sorting is three features interacting, and it is usually tested with eight records.
- The second account. Everything works for the person who built the data. Permissions fail for the colleague.
- The interrupted flow. Back button, closed tab, expired session, a payment that timed out after being taken.
- Time. Time zones, daylight saving, month boundaries, and "last 30 days" computed in the wrong place.
- Empty and enormous. Zero results and ten thousand results; both break layouts and queries that were fine with twelve.
- The retry. Anything that can be submitted twice, from a double click to a webhook redelivery.
Why these persist
They are all cases nobody writes into a requirement. A specification says what the feature does; these are what happens around it.
Most production bugs are not in the feature. They are in the space between features.
Turning the list into practice
It is a checklist on our pull request template and a set of standing charters for exploratory sessions. Cheap to maintain, and it catches things every month.