Software Testing Basics

🤔 Why We Switched from GitFlow to Trunk-Based Development (TBD) After years of using GitFlow, we've recently transitioned to Trunk-Based Development (TBD). As our projects expanded (up to 70 contributors) and complexity increased, we needed a more efficient workflow. Here's how TBD has transformed our development process: 🚀 Faster Time to Production  TBD has reduced the time it takes for new features and fixes to reach production. Developers can now push smaller, incremental updates, allowing us to ship faster and more frequently. 👥 Greater Developer Ownership  Developers have full control over their changes. With TBD, they know exactly what's going live, can monitor it closely, and roll back specific changes if necessary. This increases accountability and reduces post-release issues. 🛡️ Ensuring Quality with Automated Testing and GitOps  We have a comprehensive automated test suite and GitOps in place to ensure we deliver high-quality, secure code. Continuous integration and deployment pipelines catch issues early. 🎯 Reducing Risks with Feature Flags  By leveraging feature flags, we can test new functionality in production without rolling it out to all users. This means even if something doesn't work as expected, it's contained, and we can quickly disable it without impacting the system. 🔴 While GitFlow served us well initially, scaling highlighted several challenges: - Huge PRs on Release Day: Managing 10,000+ code changes or 50-100 commits in one release was daunting. - Delayed Bug Identification: Tracing bugs was difficult, especially if the author was unavailable. - Complex Rollbacks: Rolling back an entire release meant losing all features, not just the problematic one. - Increased Mental Load: High pressure on release managers and developers who were already working on new tasks while waiting for previous code to go live. - Database Migration Risks: Multiple migrations in a single release increased the risk of performance issues. 🟢 TBD addresses these issues effectively: - Smaller, Manageable Releases: Developers release their own features directly, resulting in fewer merge conflicts and more efficient code reviews. - Continuous Integration and Deployment: Our CI/CD pipelines, combined with automated testing and GitOps, improve collaboration and catch integration issues early. - Faster Bug Fixes: Smaller, focused code changes make it easier to identify and fix bugs quickly. - Feature Flags for Safe Testing: We can safely test features in production without affecting all users. The switch to TBD has been a great success for us at Monta, improving our time to market, efficiency and overall developer experience. With automated testing and GitOps, we maintain high code quality while moving faster. We just got started with the first couple of projects and are looking forward to expand it to all. What is your experience with TBD or other approaches? 🙋 #Engineering #TrunkBasedDevelopment #TimeToMarket

🎢 How To Roll Out New Features Without Breaking UX. Practical guidelines to keep in mind before releasing a new feature ↓ 🚫 We often assume that people don’t like change. 🤔 But people go through changes their entire lives. ✅ People accept novelty if they understand/value it. ✅ But: breaking changes disrupt habits and hurt efficiency. ✅ Roll out features slowly, with multiple layers of testing. ✅ First, study where a new feature fits in key user journeys. ✅ Research where different user types would find and apply it. ✅ Consider levels of proficiency: from new users to experts. ✅ Actively support existing flows, and keep them a default. 🚫 Assume low adoption rate: don’t make a feature mandatory. ✅ First, test with internal employees and company-wide users. ✅ Then, run a usability testing with real users and beta testers. ✅ Then, test with users who manually opt in and run a split-test. ✅ Allow users to try a new feature, roll back, dismiss, remind later. ✅ Release slowly and gradually and track retention as you go. As designers, we often focus on how a new feature fits in the existing UI. Yet problems typically occur not because components don’t work visually, but rather when features are understood and applied in unexpected ways. Rather than zooming in too closely, zoom out repeatedly to see a broader scope. Be strategic when rolling out new versions. Especially in complex environments, we need to be rather cautious and slow, especially when operating on a core feature. That’s a strategy you could follow in such scenarios: 1. Seek and challenge assumptions. 2. Define how you’ll measure success. 3. Have a rollback strategy in place. 4. Test with designers and developers. 5. Test with internal company-wide users. 6. Test with real users in a usability testing. 7. Start releasing slowly and gradually. 8. Test with beta testers (if applicable). 9. Test with users who manually opt in. 10. Test with a small segment of customers first. 11. Split-test the change and track impact. 12. Wait and track adoption and retention rates. 13. Roll out a feature to more user segments. 14. Run UX research to track usage patterns. 15. Slowly replace deprecated flows with the new one. With a new feature, the most dangerous thing that can happen is that loyal, experienced users suddenly lose their hard-won efficiency. It might be caused by oversimplification, or mismatch of expectations, or — more often than not — because a feature has been designed with a small subset of users in mind. As we work on a shiny new thing, we often get blinded by our assumptions and expectations. What really helps me is to always wear a critical hat in each design crit. Relentlessly question everything. Everything! One wrong assumption is a goldmine of disastrous decisions waiting to be excavated. [continues in comments ↓]

Red Flags Every QA Professional Should Watch For In the dynamic world of software development, Quality Assurance (QA) isn’t just about detecting bugs—it’s about ensuring excellence in the user experience, system performance, and product stability. But what happens when things go off track? Recognizing the red flags early can save teams from major pitfalls. Here are some critical red flags every QA expert must watch out for: 1. Undefined Requirements If user stories or business requirements are ambiguous or missing, your testing foundation is weak. This leads to misaligned expectations and inconsistent test coverage. Red Flag: “We’ll finalize the requirements later.” 2. Last-Minute QA Involvement QA must be involved from the requirement gathering phase. If testing is seen only as a final step, it usually results in rushed testing and missed defects. Red Flag: “We’ll add QA just before the release.” 3. No Time for Regression Testing Skipping regression testing or performing it under tight deadlines increases the risk of breaking existing features—a major cause of production defects. Red Flag: “Let’s skip regression for now.” 4. Lack of Test Environments An unstable or shared test environment often leads to inconsistent test results, impacting productivity and delaying defect validation. Red Flag: “The environment is being used by another team.” 5. Poor Communication Between Teams If developers, product managers, and QA work in silos, it leads to misunderstandings and incomplete testing. Red Flag: “I assumed that was already tested.” 6. Minimal or No Automation In 2025, relying solely on manual testing for repetitive tasks is a red flag. Test automation is essential for faster feedback cycles and scalable testing. Red Flag: “We don’t have time to automate this.” 7. No Defect Triage Process Without regular triage meetings, defects are ignored, poorly prioritized, or closed without resolution—damaging product quality. Red Flag: “We’ll review bugs before release—hopefully.” 8. Overreliance on Happy Path Testing If the focus is only on expected scenarios, edge cases and failure conditions are neglected, leading to critical bugs post-launch. Red Flag: “We only tested the main workflow.” Final Thoughts: A great QA professional doesn’t just find bugs—they prevent them by identifying process-level gaps early. If you’re noticing these red flags, raise your voice, realign with the team, and advocate for quality-first development. Let’s champion quality—every sprint, every release. #QualityAssurance #SoftwareTesting #QA #QATips #BugHunting #TestAutomation #AgileTesting #DevOps #ManualTesting #QALife #RedFlagsInQA #TestProcess #TechLeadership #SudhanshuYadav #QualityExpert

I use this simple 3-step logs flow that helps me debug almost anything in Kubernetes under 30 minutes. 𝗦𝘁𝗲𝗽 1 → kubectl logs <pod> Ask: “Did the app fail inside the container?” If the pod is up, this is your first stop. Look for stack traces, startup errors, misconfigs. But if logs show nothing (or the pod never started), move on fast. 𝗦𝘁𝗲𝗽 2 → kubectl describe pod <pod> Ask: “Did Kubernetes kill the pod?” This one’s underrated. It shows you probe failures, CrashLoops, image pull issues, and mount errors. Basically, if K8s is mad at your pod, this will tell you why. 𝗦𝘁𝗲𝗽 3 → kubectl get events --sort-by=.metadata.creationTimestamp Ask: “What else is breaking in the cluster?” This is your timeline. It shows broader issues: node pressure, CNI problems, preemptions. If the problem isn’t in logs or describe, this one usually holds the clue. This is the exact flow we use inside incident war rooms. ➤ If the pod is running → check logs. ➤ If it’s crashing or pending → check describe. ➤ If you’re still lost → check events. Don’t waste 45 minutes staring at Grafana hoping something makes sense. Start with the logs. Ask better questions. Fix faster. I built a 1-page cheatsheet of this debugging flow. It’s part of our SRE onboarding at Infra360. Want it? Drop a “LOGS” in the comments and I’ll send it to you.

While writing a material on Exploit Development and analyzing research from colleagues and friends, I noticed that each person follows a different methodology to reach a conclusion. However, they all start by achieving the minimum before reaching the expected impact. When we look for a vulnerability, we immediately want the greatest possible impact, however, noting the modus operandi of other researchers, we can notice a methodology that involves several steps before reaching the final objective. 1) What type of vulnerability and technologies are involved? Before anything else, it is essential to understand what type of vulnerability we are investigating. - What technologies does the service use? - How does it interact with other systems? - Are there any dependencies that could be exploited? 2) How does the system react to the first exploitation attempt? - Does it crash? - Does it return a useful stack trace? - Is there a flow control deviation? - Does it return sensitive data that can be exploited? - Is there a security mechanism blocking the exploitation? These questions can help define the approach to explore the vulnerability. 3) Gather detailed information before attempting a more aggressive exploitation. Many times, a methodical approach is more effective than trying an RCE or privilege escalation right away. Before escalating the exploitation, consider: - The software and operating system version. - The service permissions. - Specific configurations that may affect the vulnerability. 4) Bypass security controls one by one. If you are exploring a buffer overflow, you may encounter protections such as: - DEP - ASLR - CFI Therefore, understanding and implementing bypasses for these mechanisms is crucial. Additionally, research from other professionals can be extremely useful in helping bypass these protections. 5) Building the Proof of Concept (PoC) and testing. - Start simple. - Try a basic exploitation, such as printing a message on the system. - Gradually evolve until you reach the main goal. - Test in different environments to measure the success rate of the exploitation. These are the key points for effective research. I also remembered a tool called Exploit Pack, which follows this methodology and brings together a set of tools to identify vulnerabilities and build custom exploits all in one place. For those who can afford it, it might be an interesting tool. Link: https://exploitpack.com/ #redteam #cybersecurity #exploitdevelopment #vulnerabilityresearch

If your test suite is 95% unit tests... you might be testing the wrong thing. Unit tests are great: - fast - cheap - perfect for domain rules But most real bugs don’t live in pure functions. They show up when code meets reality: - database mappings - transactions - serialization - config - external services That’s why my rule of thumb is: - 𝗨𝗻𝗶𝘁 𝘁𝗲𝘀𝘁 𝘆𝗼𝘂𝗿 𝗱𝗼𝗺𝗮𝗶𝗻 𝗹𝗼𝗴𝗶𝗰 - 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗼𝗻 𝘁𝗲𝘀𝘁 𝘆𝗼𝘂𝗿 𝘂𝘀𝗲 𝗰𝗮𝘀𝗲𝘀 Best setup I’ve used: integration tests with Testcontainers. If it runs in Docker, you can spin up real dependencies locally and in CI without pain. Want to set it up from scratch? Here's a complete from-scratch guide: https://lnkd.in/dAfw5dtM What’s your testing setup? --- Do you want to simplify your development process? Grab my Clean Architecture template here and save 7 days of development time: https://lnkd.in/dYNsNb52

A developer’s guide to a more effective software testing. 1. To be effective developers, we must become effective software testers. Developers have the responsibility to ensure our software works at both the time of writing and in the future. Writing automated tests is the best and cheapest way of fulfilling our responsibility. We must get proficient at writing automated tests and make it a habit. And we should be more systematic in coming up with test cases, instead of doing it randomly. 2. Code coverage is NOT a target to measure. Instead, we should use code coverage as complementary to the requirements-based testing. The main purpose of code coverage is to give us insights about where to improve in our test suite by identifying poorly tested areas of our code base. Often, it also serves as a feedback loop to strengthen our understanding of the requirements. 3. Always write software incrementally in a steady small step, instead of in a big chunk. More recent research shows the main benefit of TDD is on the ability to work in small steps, and not because of writing the test before the production code. Regardless of being dogmatic about TDD or not, we can use TDD as one of the best ways to train us to work in small steps. Working in small steps increases our feedback loop cycle and improves flow overall. — Like this content? • Listen to my episode with Maurício Aniche on https://lnkd.in/deZfdmtr. • Join 16,700+ following Tech Lead Journal page. • Subscribe to techleadjournal.dev newsletter. • Follow me to get my future posts. #engineering #tech #testing #softwaretesting

𝗬𝗼𝘂𝗿 𝘁𝗲𝘀𝘁 𝘀𝘂𝗶𝘁𝗲 𝗶𝘀 𝗴𝗿𝗲𝗲𝗻. 𝗬𝗼𝘂𝗿 𝘁𝗲𝘀𝘁 𝗱𝗮𝘁𝗮 𝗶𝘀 𝗳𝗶𝗰𝘁𝗶𝗼𝗻. 𝗚𝘂𝗲𝘀𝘀 𝘄𝗵𝗶𝗰𝗵 𝗼𝗻𝗲 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝗯𝗲𝗹𝗶𝗲𝘃𝗲𝘀. Most teams I meet can quote their test coverage to two decimals. Very few can tell me where their test data comes from. That gap is expensive. A suite built on stale or invented data reports green while the real edge cases sit waiting in production. You are not testing your software. You are testing a story about your software. I put it bluntly in my book: no test data strategy means flaky tests, late releases, and compliance nightmares. 𝗧𝗵𝗲 𝗽𝗮𝗿𝘁 𝗽𝗲𝗼𝗽𝗹𝗲 𝗺𝗶𝘀𝘀: 𝘁𝗲𝘀𝘁 𝗱𝗮𝘁𝗮 𝗶𝘀 𝗮 𝗳𝗲𝗲𝗱𝗯𝗮𝗰𝗸 𝗹𝗼𝗼𝗽. When the data is wrong, the loop lies to you. Speed on top of a lying feedback loop is not progress, it is risk moving faster. Then AI raises the stakes. The quickest way to leak customer data in 2026 is to hand a production dump to an external model "to help with testing." That one shortcut can breach GDPR, HIPAA, or PCI-DSS in an afternoon. This is why test data management is now a safety layer. Synthetic and masked data lets you run realistic tests, and let AI work on them, without ever exposing a real customer record. Own your data layer, mask it, then let AI in. What good looks like: - Provisioning automated and shifted left into the pipeline, not hand-assembled the night before release - Synthetic and masked data instead of raw production copies - Test data as code, versioned next to the tests it feeds - Self-service, so engineers stop waiting on a DBA None of this is exotic. It is discipline applied to the least glamorous input in engineering, the one that quietly decides whether every test above it is telling the truth. So before you celebrate 90% coverage, ask the harder question: do you trust the data those tests run on, or are you just testing fiction faster? #TestDataManagement #ShiftLeft #ContinuousDelivery #DevOps #DataPrivacy #SoftwareTesting

The cheapest place to fix a mistake in a software project is on a piece of paper, not in six months of code. Writing a clear requirement is a great start. But the real skill, the thing that separates a good project from a great one, is actively trying to break the logic before you build it. Here at Full Metal, we call this pre-emptive debugging. We map out the "happy path," where the user does everything perfectly. But then we spend more time on the "unhappy paths." We ask a series of 'what if' questions. For a simple password reset feature, we'll ask: ❌ What if the user enters an email that isn't registered? ❌ What if they click the reset link after it has expired? ❌ What if they try to reuse an old password? Each of those 'what ifs' becomes a new requirement, closing a loophole that could have caused problems down the line. It's about finding flaws where they're free to fix. This also helps us avoid common pitfalls I've seen time and again. The biggest is the ambiguity trap: using fuzzy words like "fast" or "easy." My "fast" is not your "fast." Instead of "The system should be quick," we define it: "The system shall return a response within 500ms." One is a wish; the other is a testable fact. This meticulous approach might seem like a lot of work up front, but it saves a fortune in rework and frustration later on. We explore these common pitfalls and how to avoid them in our latest blog for SME leaders. Find the blog here: https://lnkd.in/eptHVTKA Have you ever had a project go a bit pear-shaped because of a single, unasked 'what if' question? #SoftwareEngineering #RiskManagement #DigitalTransformation