$ cd ./topics/testing-quality
Testing strategies teams actually adopt, mocking at the network, end-to-end confidence, shifting left, and the security habits that belong in the same pipeline.
14 notes🌱 1 seed🌿 9 growing🌳 4 evergreen
Quality is a feedback loop, not a phase. These notes cover how I test front ends (at the network boundary, test-first where it pays, end-to-end where it matters), how to shift those checks left into the pipeline, and the security hygiene that belongs alongside them.
hover to explore · click to open
Case study — raising coverage with network-level mocks instead of brittle ones, shipping features test-first, speeding up quality checks, and getting Playwright adopted across several teams.
Intercept HTTP at the network layer so tests, Storybook and local development all hit realistic mocked APIs while your real fetching and parsing code runs.
React escapes what you put in JSX, so most XSS comes through the escape hatches — dangerouslySetInnerHTML, direct DOM writes, javascript URLs and third-party scripts. Defend in layers.
Put logic in plain functions and unit-test them; test hooks and pages as integration tests against a mocked network; assert only on what users can observe.
Mocking fetch or your own API modules couples tests to implementation and quietly re-implements your backend in every test file. Mock the network boundary instead.
My 2022 post on deployment hooks argued for building every pull request on real infrastructure, but failing fast. What I'd add: preview environments, a quick PR tier and a thorough merge tier, and releases you can flip back.
A regression with no obvious cause and hundreds of commits to search: git bisect halves the range each step, and with a test script it can find the culprit on its own.
In 2020 I sold TypeScript as documentation you get for free. Since then I've migrated a large codebase to zero type errors. Types are a contract between people as much as between functions, but only if the build enforces them.
The author of Clean Code now argues humans shouldn't review AI-written code line by line: specify what correct means, verify it with deterministic tools, and keep humans accountable for specs and sign-off.
End-to-end tests in real browsers with accessible locators, auth handled once via saved storage state, network control for deterministic runs, and traces that make CI failures debuggable.
Scan for leaks, rotate first, rewrite history with regex patterns rather than literal lists, and add a pre-commit scanner so it never happens again.
Specific Adaptation to Imposed Demands — you get good at exactly what you practise. Tests and staging only prepare a system for the conditions they simulate.
Find defects where they're cheapest to fix, in refinement, the editor and the pull request. But shift-left means early feedback, not running every expensive test at the earliest stage.
Red, green, refactor is less about tests than about tight feedback — and in the age of coding agents, a failing test is the clearest instruction you can give.