QA and software testing
Test automation is an investment with a payback period, and most teams never calculate it. A suite that takes three weeks to write and catches a bug twice a year has not paid for itself. Knowing which tests are which is most of the job.
Where automation earns its keep
On the paths that are expensive when they break and boring to check by hand: checkout, authentication, permissions, anything involving money or tax, and any calculation with more than three inputs. These get automated first and thoroughly, because they are checked on every release forever and a human doing it will eventually stop reading carefully.
Where it does not earn its keep: a screen that is about to be redesigned, a layout that changes weekly, and anything whose correctness depends on judgement rather than on a rule. Automating those produces a suite that fails constantly for reasons that are not bugs — and a suite people ignore is worse than no suite, because it costs money and supplies false assurance at the same time.
The testing pyramid, applied honestly
Most of the value sits in fast tests close to the code: unit tests on the business rules, integration tests at the boundaries where your system talks to a database or an external API. These run in seconds and tell you exactly what broke.
End-to-end tests are the smallest layer and the most expensive to maintain, so they are reserved for the handful of journeys that must never break. A team with two hundred end-to-end tests and no unit tests has built the pyramid upside down, and will spend most of its time investigating flaky failures rather than finding bugs.
The testing that is not automated
Exploratory testing — a person deliberately trying to break the thing, working to a charter rather than a script — finds a category of problem no automated suite ever will, because it involves noticing that something is wrong rather than checking that something matches a specification.
The same goes for accessibility. Automated tooling catches perhaps a third of real accessibility problems: missing alternative text, contrast failures, unlabelled controls. The rest — whether a keyboard user can actually complete the task, whether the focus order makes sense, whether a screen reader announces something coherent — requires a person to sit down and try it.
What this actually covers
Test strategy
A written assessment of what to automate, what to test by hand and what not to test at all — with the reasoning for each.
Automated regression
Fast unit and integration suites on the business rules, plus a small, stable set of end-to-end journeys.
Exploratory testing
Charter-based sessions by someone trying to break it, which finds the class of bug no script anticipates.
Performance testing
Load and soak testing against realistic data volumes, so the bottleneck is found before your users find it.
Accessibility testing
Automated checks plus real keyboard and screen-reader passes against WCAG 2.2 AA. The automated part is a third of it.
CI integration
Suites wired into the pipeline so a regression fails a build, with flaky tests quarantined rather than tolerated.
The sequence
Same shape on every engagement, so you always know what week you are in and what happens next.
Risk-rank the system
What is expensive when it breaks, what breaks often, and what is hard to check by hand. Test effort follows that ranking rather than following the feature list.
Automate the expensive paths first
Money, authentication, permissions and tax. Fast tests close to the code before slow tests far from it.
Wire it into CI
A suite that has to be run manually will stop being run. Suites go in the pipeline, and a flaky test is quarantined and fixed rather than re-run until it passes.
Exploratory and accessibility passes
Human sessions against a charter, plus real keyboard and screen-reader testing — the two-thirds of accessibility that tooling cannot see.
Handed over, in your accounts
Not a demo and a login. These are the artefacts you keep, and they are what makes leaving us possible.
- A written test strategy with the automation payback reasoning made explicit
- Automated suites in your repository, running in your CI pipeline
- A regression checklist for the paths that stay manual, and the reason they do
- Defect reports with reproduction steps, environment and severity — not screenshots in chat
- A performance baseline, so future changes can be compared against a number
- An accessibility audit against WCAG 2.2 AA with issues ranked by user impact
Typically built with
- Playwright
- Vitest
- Jest
- Cypress
- k6
- axe-core
- GitHub Actions
- Detox
The selection principle is deliberately dull: largest hiring pool, longest support window. See why we choose these.
QA & Testing, answered
The things people ask on the first call, written down so you do not have to.
How much testing does our project actually need?
Enough that the paths which are expensive to get wrong are checked automatically on every release, and not much more than that. We risk-rank first: what costs money when it breaks, what breaks often, what is tedious to verify by hand. A payments flow deserves thorough automated coverage. A marketing page that changes monthly deserves almost none. The failure mode we see most often is a uniform coverage target — chasing eighty percent everywhere produces a great many tests on trivial code and a false sense of safety.
Our test suite is slow and flaky. Can you fix it?
Usually, and the diagnosis is nearly always the same: too many end-to-end tests, too few unit tests, and shared state between tests so they interfere with one another. The fix is to push coverage down the pyramid — replace slow browser tests with fast tests on the same business rules — and to make every test set up and tear down its own data. Flaky tests get quarantined immediately rather than re-run until they pass, because a suite people re-run on failure has already stopped being a signal.
Do you do accessibility testing?
Yes, against WCAG 2.2 AA. It is worth being honest about the split: automated tooling catches roughly a third of real problems — missing alternative text, contrast failures, unlabelled form controls. The other two-thirds need a person to navigate the whole task by keyboard, listen to what a screen reader actually announces, and judge whether the focus order makes sense. We do both, and the report ranks issues by how much they block a real user rather than by how many instances of each there are.
Can you test an application you did not build?
Yes, and it is often more useful than testing our own work, because we come to it without assumptions about how it is supposed to behave. We start with a risk-ranking exercise and an exploratory pass, which typically surfaces a set of issues within the first few days. You get a defect report with reproduction steps and severity, plus a recommendation on where automation would pay for itself if you want to go further.
What usually comes with this
- BuildCustom Software DevelopmentCustom platforms, marketplaces and SaaS. We write the parts that are specific to your business and buy the parts that aren’t.Read more
- RunCloud & DevOpsDeploys that are boring on purpose. Infrastructure as code, real environments, and a bill you can read line by line.Read more
- RunMaintenance & SupportTaking over a system someone else wrote — including the archaeology needed before anyone can safely change it.Read more
- BuildMobile App DevelopmentReact Native when one codebase is genuinely enough. Native when it isn’t — and we will tell you which before you commit a budget.Read more
Thinking about qa & testing?
Start with a call rather than a brief. Thirty minutes, no deck, and an honest answer about whether we are the right people for it.

