Controls Inside the Frame
When a control lives inside an iframe, point the locator at that frame with frameLocator. A locator on page searches the outer document and misses it.
Quality Engineering, Automated.
Practical articles on QA automation, Playwright, Java, TypeScript, DevOps, and software engineering.
Reading paths
Eight reading paths, from QA fundamentals to security testing.
QA General
7 partsFoundational posts on software quality, QA roles, testing types, methodology, and accessibility.
ISTQB Foundation Level
11 partsComplete walkthrough of the ISTQB CTFL syllabus — from testing principles to defect management.
Playwright Essentials
17 partsHands-on E2E testing with Microsoft Playwright — from the first test through network control, browsers, permissions, files, and the page, frame, or dialog the click actually opened.
Automation Strategy
8 partsWhen to automate, what to automate first, and how to keep suites maintainable — including the paths that fail.
CI/CD Quality
8 partsQuality gates, GitHub Actions, Dockerised E2E, reports, continuous testing, and what QA owns after release.
Test Architecture
5 partsLayered test design, stable environments, observability, testability, and the component layer between unit and E2E.
AI for QA
3 partsPractical uses and real risks of AI in test design, maintenance, and generation.
Security Testing Basics
5 partsPractical security testing for QA — mindset, ZAP triage, access control, sessions, and the checks that belong in CI.
Latest Posts
Assert on the Page the Click Opened
When a click opens a popup or a new tab, assert on that page. The opener staying put is not evidence the new window worked.
Security Checks That Belong in CI
Put secret scanning, dependency review, and a ZAP baseline in CI. Fail the build only on findings you already treat as release blockers.
Sessions, Cookies, and CSRF
Check that logout kills the session, cookies are flagged, and a cross-site POST cannot ride the user's cookie.
Access Control Cases a Scanner Will Miss
Find access-control bugs a scanner misses: a swapped object id, a lower role, and another user's data in the response.
What QA Owns After Deploy
Decide what QA watches in the first hour after release: synthetic journeys, the signal to stop, and the test you add afterwards.
Files Users Actually Send — Upload, Download, and Content
Test the files users upload and download: type, size, name, and a look inside. An enabled button is not proof the file survived.
Accessibility Beyond Automated Checks
Treat axe as a gate, not a verdict. Walk the keyboard path, names, and focus, and keep the issues tools cannot see.
Browser Permissions Users Refuse
Test geolocation, clipboard, camera, and notifications when the user says no. A fixture that grants them all hides that path.
Which Browsers Actually Earn a Test Run
Run Chromium on every pull request. Add Firefox and WebKit only where those engines produce bugs you have actually seen.