Glossary

44 terms, alphabetical. Each term is glossed at its first use on a page; this list links to the page where it first appears.

accessibility testing
Checks against WCAG 2.2 AA with tools and assistive technology. First used on /how-to-test/accounting-saas/
analytics and event tracking tests
Verifying that events fire with the right payload at the right moment. First used on /how-to-test/bnpl-service/
by design analysis
A risk attached from the structure of the product (it moves money, it stores personal data, it ships through a store), capped at secondary grade. First used on /how-to-test/bnpl-service/
chargeback
A card payment reversed by the cardholder's bank after a dispute. First used on /how-to-test/p2p-payment-app/
compliance checks
Verifying requirements set by a regulator, a standard or a store policy. First used on /how-to-test/accounting-saas/
contract tests
Checks that a provider API still matches what each consumer expects. First used on /how-to-test/accounting-saas/
COPPA
The US Children's Online Privacy Protection Act rule, which limits data collection from children under 13. First used on /how-to-test/kids-app/
DAST
Dynamic application security testing: probing a running application for vulnerabilities. First used on /tests/security-scan/
data integrity and migration testing
Verifying data stays correct through writes, migrations, imports and exports. First used on /how-to-test/accounting-saas/
device and browser compatibility
Running key flows across the device, OS and browser matrix. First used on /how-to-test/accounting-saas/
done condition
One sentence, in present tense, that a non-engineer can check without reading code. First used on /how-to-test/fleet-tracking/
end-to-end functional tests
Scripted user journeys through the real UI against a deployed build. First used on /how-to-test/accounting-saas/
exploratory testing
Unscripted, time-boxed testing by a person following risk and curiosity. First used on /how-to-test/accounting-saas/
GDPR
The EU General Data Protection Regulation, which sets rules for processing personal data. First used on /how-to-test/email-marketing-platform/
HIPAA
The US law that sets privacy and security rules for protected health information. First used on /how-to-test/mental-health-app/
idempotency
The property that repeating the same request does not repeat its effect, such as a second charge. First used on /glossary/
integration tests
Automated checks of two or more components together, often with a real database or queue. First used on /how-to-test/accounting-saas/
localization testing
Checking translations, formats, directions and currencies per locale. First used on /how-to-test/accounting-saas/
mandatory test
A test that addresses at least one attached risk on the page. First used on /how-to-test/pharmacy-delivery/
offline and poor-network testing
Running flows with no, slow or flapping connectivity. First used on /how-to-test/clinical-trial-software/
OWASP
Open Worldwide Application Security Project, which publishes security standards such as the Top 10 lists. First used on /tests/security-scan/
payment and money-flow testing
Scripted cases through provider sandboxes: declines, refunds, chargebacks, partial captures, currency. First used on /how-to-test/accounting-saas/
PCI DSS
Payment Card Industry Data Security Standard, the security rules for systems that handle card data. First used on /how-to-test/ecommerce-store/
penetration testing
Manual attack by a skilled tester against a defined scope. First used on /how-to-test/accounting-saas/
performance and load testing
Measuring response times and behaviour under expected and peak load. First used on /how-to-test/accounting-saas/
PHI
Protected health information: health data linked to an identifiable person. First used on /how-to-test/ehr-system/
PII
Personally identifiable information: data that identifies a person, such as a name, email or ID number. First used on /risks/data-breach/
post-mortem
A write-up by the affected company of what failed, why, and what changed afterwards. First used on /methodology/
practitioner evidence
A named practitioner post or answer; two are needed to attach a risk. First used on /methodology/
primary evidence
A regulator page, store guideline, standard, official post-mortem, or court or fine record. First used on /guides/what-to-test-before-app-store-submission/
regression
A bug in behaviour that used to work. First used on /how-to-test/accounting-saas/
regression suite
The subset of tests rerun on every change to catch what used to work. First used on /how-to-test/accounting-saas/
release smoke tests
A short fixed set run on every build before release. First used on /how-to-test/accounting-saas/
resilience and failure testing
Injecting failures (timeouts, dependency down, partial outage) to see recovery. First used on /how-to-test/accounting-saas/
risk map
The table of risks attached to a product type, each with severity, evidence grade and a note. First used on /how-to-test/ecommerce-store/
sandbox
A provider test environment that accepts test cards or accounts and moves no real money. First used on /how-to-test/accounting-saas/
SAST
Static application security testing: scanning source code for vulnerability patterns. First used on /tests/security-scan/
secondary evidence
An engineering incident write-up, conference talk, audited industry report, or a by design analysis backed by a primary general requirement. First used on /guides/what-to-test-before-app-store-submission/
security scanning
Automated SAST, DAST and dependency checks. First used on /how-to-test/accounting-saas/
severity
The kind of damage a risk causes: money, harm, legal, outage, data, distribution or trust. First used on /how-to-test/clinical-trial-software/
staging
A deployed copy of the product used for testing before release. First used on /how-to-test/clinical-trial-software/
unit tests
Automated checks of one function or class in isolation. First used on /how-to-test/accounting-saas/
usability testing
Watching representative users complete tasks. First used on /how-to-test/accounting-saas/
WCAG
Web Content Accessibility Guidelines, the W3C standard that accessibility testing checks against. First used on /how-to-test/government-portal/