🎮 The Playground — Practice on Real Apps

Goal: stop reading, start doing. These are safe, legal, deliberately-testable apps. Each one comes with a mission and a win condition — complete them and you’ll have real artifacts for your portfolio. Testing is a skill; skills need reps.

⚠️ Rule of the arena: only test the apps listed here (or your own). They’re built for practice. Never point tools at systems you don’t own or aren’t authorized to test.

🥉 Missions — Manual & Functional

Mission 1 — Break the checkout

App: SauceDemo (a full mock store; try the locked_out_user and problem_user logins too) Mission: design and run a checkout test suite using EP/BVA. Try the different user types — one of them has deliberately broken behavior. Win: 15+ test cases in your template, and at least 3 written-up bugs.

App: the-internet (every hard UI element: iframes, dynamic loads, file uploads, auth) Mission: write exploratory charters for 5 of the trickiest pages. Time-box 30 min each. Win: session notes documenting what you tried and what surprised you.

App: Automation Exercise Mission: run one complete E2E journey (register → browse → cart → checkout) and one negative pass (invalid data at every step). Win: an E2E test case set + a bug journal.

🔌 Missions — API

Mission 4 — CRUD and destroy

App: restful-booker (deliberately buggy booking API) Mission: in Postman, test create → read → update → delete asserting all four layers (status, body, headers, side effects). Attack auth with expired/invalid tokens. Win: a runnable Postman collection (40+ requests, negatives included) + a README of the bugs you found.

Mission 5 — The contract check

App: ReqRes / GoRest Mission: validate responses against their schema; find one place where reality doesn’t match the docs. Win: a documented contract-vs-reality gap.

🔐 Missions — Security (learn the OWASP mindset first: Stage 13)

Mission 6 — Steal your own basket

App: OWASP Juice Shop (run locally — built for this) Mission: find one Broken Access Control issue (view another user’s data) and land one XSS payload. Win: two security bugs written up with severity justified — and set up OWASP ZAP as a proxy to capture + modify one request.

Mission 7 — The vulnerable API

App: OWASP crAPI Mission: find one API authorization flaw (BOLA/IDOR at the API level). Win: a reproduction with the exact requests.

⚡ Missions — Performance (method: Stage 15)

Mission 8 — Find the knee

App: test.k6.io (safe to load-test) Mission: write a k6 load test (ramp → hold → down) with a p(95)<800 threshold and think-time. Then turn it into a spike test. Win: a report with p50/p95/p99, throughput, error rate, and the load level where it starts to bend.

🤖 Missions — Automation & AI (build: Stage 14 · agents: Stage 11)

Mission 9 — Your first green pipeline

App: SauceDemo Mission: automate 8–10 regression cases in Playwright (POM, data-driven), running in GitHub Actions on every push. Win: a public repo with a green CI badge and an HTML report artifact.

Mission 10 — Let an agent explore

App: any practice app above Mission: set up Playwright MCP and have an AI agent explore it; compare its bug list to yours. Win: a write-up of what the agent caught, what it missed, and which of its generated assertions you’d actually keep.

🏆 The meta-mission

Complete missions across at least four categories and you’ll have a portfolio that beats any certificate: manual test cases, bug reports, a Postman collection, a security finding, a k6 report, and a green automation pipeline. That’s not a “learner” — that’s a hire.

💬 Finished a mission? Share it in an issue — I feature great ones.

← Back to the roadmap