📌 QA Cheatsheets

Goal: fast, dense reference cards you can glance at (or put on screen while recording). No fluff — the things you look up mid-task. Inspired by educative.io/cheatsheets, tuned for QA.

🌐 HTTP status codes

🔎 Demo live: httpbingo.org/status/404 returns any code on demand · http.cat for a memorable visual.

🧪 Test design techniques

🐞 Severity vs Priority

Severity = impact (QA owns). Priority = fix order (product owns, you advise).

🎭 Playwright quick reference

npm init playwright@latest         # scaffold
npx playwright test                # run all
npx playwright test --headed       # watch it run
npx playwright test --ui           # interactive UI mode
npx playwright codegen <url>       # record a test
npx playwright show-trace trace.zip# debug a failure

await page.goto('/login');
await page.getByLabel('Email').fill('me@x.com');
await page.getByRole('button', { name: 'Sign in' }).click();
await expect(page.getByText(/welcome/i)).toBeVisible();
await expect(page).toHaveURL(/dashboard/);

Locator priority: getByRole > getByLabel/Text > getByTestId > CSS > (avoid) positional XPath. 🔎 Docs live: playwright.dev

🔌 Postman assertions (Tests tab)

pm.test("status 200", () => pm.response.to.have.status(200));
pm.test("has id", () => pm.expect(pm.response.json().id).to.be.a("number"));
pm.test("fast", () => pm.expect(pm.response.responseTime).to.be.below(800));
pm.test("schema", () => pm.response.to.have.jsonSchema(schema));

newman run collection.json -e staging.json   # run in CI

🔎 Practice live: reqres.in · restful-booker · Postman Echo

🗄️ SQL for QA (the 5 that cover 90%)

SELECT * FROM orders WHERE id = 8812;                       -- did it persist?
SELECT COUNT(*) FROM orders WHERE user_id=42 AND status='shipped';
SELECT email, COUNT(*) FROM users GROUP BY email HAVING COUNT(*)>1;  -- dupes
SELECT o.id FROM orders o LEFT JOIN invoices i ON i.order_id=o.id
  WHERE o.status='paid' AND i.id IS NULL;                   -- cross-table gaps
SELECT * FROM audit_log WHERE entity_id=8812 ORDER BY created_at DESC LIMIT 20;

Read-only on staging. Never write. 🔎 Practice live: SQLBolt · DB Fiddle

⚡ k6 performance

export const options = {
  stages: [ {duration:'2m',target:200}, {duration:'5m',target:200}, {duration:'2m',target:0} ],
  thresholds: { http_req_duration:['p(95)<500'], http_req_failed:['rate<0.01'] },
};

k6 run script.js

| Test | Shape | |—|—| | Load | ramp → hold → down | | Stress | ramp past breaking point | | Spike | sudden jump → drop | | Soak | moderate, held for hours | 🔎 Practice live: test.k6.io · docs: grafana.com/docs/k6

🔐 OWASP Top 10 (QA lens)

| Risk | Quick manual test | |—|—| | Broken Access Control | Change resource id / role in the request (IDOR) | | Injection | ' OR '1'='1' --, <script>alert(1)</script> | | Crypto Failures | HTTPS everywhere? tokens/PII in URLs/logs? | | Security Misconfig | Stack traces shown? default creds? | | Auth Failures | Lockout? session invalidated on logout? | 🔎 Practice live: OWASP Juice Shop · learn: PortSwigger Academy

🧠 AI × QA quick start

claude mcp add playwright -- npx @playwright/mcp@latest   # AI drives a real browser

• Prompt for test ideas: “Act as a senior QA — what conditions am I missing? Focus on boundaries, states, concurrency.”
• Eval tools: promptfoo · DeepEval
• Rule: AI drafts, you decide. Always verify.

🛠️ Handy dev/QA utilities (bookmark these)

← Back to the roadmap · Next → Teaching Kit & Demo Sites