Best Practices for Exploratory Testing Sessions

When I talk to people and teams about their API testing strategy, the discussion often quickly focuses on test automation. And that's understandable, to some extent, as APIs lend themselves very well to automation. An API is an interface written to be consumed by other systems, after all. However, there's a lot you can gain from exploratory testing at the API level, too. In fact, I think this should be the starting point for your API testing efforts, not an afterthought (or even worse, not given any thought at all). Quick example: most team will have a test that verifies the POST request in the image below. They verify that the API call returns an HTTP 201, and that the data has been stored properly in the database. Excellent. This is a great starting point for further exploration of this endpoint. Here are some ideas: * What happens if you leave out the 'major' field (assuming that it is a mandatory field)? How does the endpoint respond? * What happens if you set the 'major' field to an empty string? Does your endpoint accept that? Should it? * What happens if you set the 'major' field to a value that contains special characters? Emojis? Other interesting values? Are they processed and stored as expected? * What happens if you set the 'major' field to '<script>alert('Hello!');</script>' (JavaScript injection) or '1'; DROP TABLE users-- 1' (SQL injection)? Do you maybe have a security issue at hand here? * What happens if you try and create hundreds or thousands of students in a very short time? Is your system up to that task? Alternatively, does your API rate limiting kick in as expected? Most testers get very creative when you give them a form in a graphical user interface and ask them to come up with tests for it. Why don't we do this at the API level more often? In the end, that API is just another interface that takes data, just like a UI form. Our approach to testing it can (and should) be very similar. Go beyond what is written in the API specs. Try and find out if we missed anything during design or development. Not all of these tests have to be converted to an automated test that is run every time. Some of them might, though, especially if they uncover new and valuable information. Oh, and by all means, perform this exploration as a team. Developers, testers, everybody. Together. In pairs, in groups, with the whole team. It is fun and everybody learns.

Chatting to a junior tester shadowing interviews this week, we discussed things to look out for in conversation. Sharing my notes, I told them to remember W.A.T.E.R, for their Exploratory Testing Journey . Exploratory Testing is…already something written about by lots of people so won't repeat everything here. But for the benefit of those just learning about Exploratory Testing, a Product Manager or someone who wants to be part of an interview for a software role, lets recap — have a wee sip. I use a W.A.T.E.R acronym, to help people I collaborate or mentor (not just testers) remember the fundamental principles that make Exploratory Testing a valuable and effective approach in software quality. W — Wide Coverage Exploratory testing aims to cover as many areas of the application as possible. Testers explore various features, functions, and user paths to ensure that the parts of the system their oracle knowledge tells them to cover, which might be missed in scripted/fallible testing. A — Adaptive Approach Exploratory testing is highly adaptive. Testers continuously learn and adapt their testing strategies based on their findings. This flexibility allows testers to pivot and focus on areas that seem more error-prone or that reveal unexpected behaviours. T — Time-Efficient Exploratory testing can be more time-efficient compared to traditional testing methods. Without the need for detailed test case documentation beforehand, testers can start testing immediately. This efficiency is particularly beneficial in agile environments where quick feedback is crucial. E — Experience-Driven The success of exploratory testing heavily relies on the tester’s experience and intuition, we sometimes call this their Oracle experience. Skilled testers use their knowledge of the application, the domain, and common software issues to guide their testing efforts. Their experience helps in identifying critical issues that automated tests might overlook. R — Realistic Scenarios Exploratory testing often involves simulating realistic user scenarios whilst also considering real life experiments that might be going on across your engineering domains. Testers interact with the application as real users would, uncovering usability issues and ensuring the application behaves as expected under real-world conditions. This approach helps in finding bugs that affect the end-user experience or will be detrimental to Product Health or Value. I then follow it up in my head, seeing an image of a superhero, hands on hips, with a bubble saying: With Advice (Oracle Knowledge), Tools, Exploration of Resources and Charters, Uniqueness Prevails. Because all testers are heroes in my head… #exploratoryTesting #testing #interviewing #intervews

��𝐀 𝐋𝐞𝐚𝐝𝐞𝐫𝐬: is your exploratory testing catching every flaw? Your current method could be letting critical issues slip by… Here's the reality: without a clear plan, exploratory testing can quickly become a chaotic search where key areas go unexamined. When there’s no defined objective, scope, or time limit, important issues may remain hidden, all while you’re under pressure to deliver fast. A simple testing guide, otherwise known as a test charter, can change that. A test charter is essentially a brief plan for a testing session. It lays out what you need to explore, pinpoints which features demand your focus, and sets a realistic timeframe for your efforts. This guide is especially useful in exploratory testing where the absence of strict instructions might otherwise lead you astray By defining a clear objective, you know exactly what you’re aiming to test. Establishing a precise scope ensures that you concentrate on the parts of your application that matter most, rather than drifting into less relevant areas. A set time limit helps keep your session efficient and prevents the process from becoming an endless search. Moreover, a test charter outlines your testing approach. Whether you’re examining usability or hunting for unexpected errors, having this plan creates a balance between creative exploration and the structure necessary to uncover hidden flaws. It prevents the common pitfall of missing vital issues simply because the testing session was too unfocused. If your testing sessions feel scattered and you worry that something vital is being overlooked, it’s time to rethink your approach. Integrating a test charter into your process can bring the order you need while still allowing for the flexibility to explore and discover. #TestCharter #ExploratoryTesting #QualityAssurance

Not every bug can be caught with scripted tests. That is where exploratory testing comes in. I put together a 25 Exploratory Testing Q&A Guide that breaks down how to test beyond the script, including: • How to design charters that guide but don’t restrict exploration • Practical heuristics like SFDPOT and test tours to spark new ideas • Ways to document findings without slowing down creativity • Pair exploratory testing with automation for maximum coverage • Best practices for APIs, mobile apps, and negative scenarios Exploratory testing is not random clicking. It is structured discovery that uncovers issues scripted cases miss. Grab the PDF below and share it with someone on your team who could use a refresher on exploratory testing.

Exploratory Testing helps to discover issues that scripted tests might miss and improve the overall application quality. Here are some tips to make exploratory testing more effective: 1️⃣ Divide and Conquer: Breaking down the software into modules allows for easier testing and more thorough coverage. 2️⃣ Team Diversity: Assemble a team with varied backgrounds. Different perspectives often lead to more comprehensive testing. 3️⃣ Time-Boxing: Keep testing sessions to 60 - 90 minutes. This ensures a constant focus and energy - crucial for quality testing. 4️⃣ User Personas: Test the software considering different user personas. This approach helps in understanding the varied user experiences and identifying potential issues. 5️⃣ Documentation: Keep a record of your insights, interesting findings, and useful heuristics that emerge during testing. This information can be a goldmine for future tests. Remember, exploratory testing is about thinking outside the box and learning on the go. Do you have any other tips for effective exploratory testing? Feel free to share them below! #SoftwareTesting #ExploratoryTesting #QualityAssurance