Test Business Workflows

Look for normal-looking requests that produce outcomes the business never intended. Prove the outcome, not merely that an unusual value was accepted.

Bound the work safely

1. Identify source roots, specifications, runtime scope, supplied identities, sandbox/test mode, and critical workflows.
2. Do not send live requests without clear authorization. Use source, tests, schemas, and captured traffic to model workflows otherwise.
3. Treat supplied accounts, customer data, billing objects, orders, balances, coupons, invitations, and integrations as protected.
4. Require a disposable fixture or explicit dry-run/preview/test mode before creating orders, changing plans or roles, transferring value, consuming benefits, sending messages, registering webhooks, or mutating persistent state.
5. Define before state, expected effect, authoritative readback, restoration, and cleanup before every mutation or race batch. Stop on unexpected side effects or instability.

Reconstruct the real workflow

For each critical workflow, combine code, UI, schemas, tests, background jobs, JavaScript, and authorized traffic. Record: