Телеграм канал «QA Community»

🚨 Are your cookies exposing user data?

🔐 What can a Manual QA test in cookies for security?
Continuing the security testing topic.

Cookies often store sensitive data - and are a common attack target. Even without automation, QA can find critical issues:

✔️ Secure flag - only HTTPS
✔️ HttpOnly - protects from XSS
✔️ SameSite - prevents CSRF
✔️ No sensitive data in cookies
✔️ Proper expiration & logout
✔️ Correct domain & path
✔️ Session ID changes after login

💡 No complex tools needed - just attention to detail.

Small checks → Big impact.

👉 What’s the worst cookie issue you’ve found?

#QA #SoftwareTesting #SecurityTesting #OWASP #ManualTesting #WebSecurity

🚨 Are your cookies exposing user data?
🔐 What can a Manual QA test in cookies for security?

Continuing the security testing topic.

Cookies often store sensitive data — and are a common attack target. Even without automation, QA can find critical issues:

✔️ Secure flag — only HTTPS
✔️ HttpOnly — protects from XSS
✔️ SameSite — prevents CSRF
✔️ No sensitive data in cookies
✔️ Proper expiration & logout
✔️ Correct domain & path
✔️ Session ID changes after login

💡 No complex tools needed — just attention to detail.

Small checks → Big impact.

👉 What’s the worst cookie issue you’ve found?

#QA #SoftwareTesting #SecurityTesting #OWASP #ManualTesting #WebSecurity

“It was just a tiny change…”
Those were the last words the developer said before chaos erupted.

A bug in the checkout system was fixed. Retesting passed. Everything looked fine. ✅

Hours later:
❌ Payments failed
❌ Orders disappeared
❌ Support tickets flooded in

All because of one small change.

Welcome to Change Related Testing. Even a tiny update can ripple across the system. It’s not just testing the new feature - it’s asking: “What else could break?”

🔹 Testing That Saves Products
Retesting: confirm the bug is fixed
Regression: ensure nothing else broke
Smoke/Sanity: check build stability & affected features
Impact Analysis: see which modules might be affected

🔹 Real-world reminders
Knight Capital (2012): one line → $440M loss
Amazon S3 (2017): minor config → thousands offline
Ariane 5 (1996): number bug → rocket exploded → $370M loss

Lesson: small changes → massive consequences

💬 What’s the smallest change that caused the biggest bug in your project? 👀

Dev: ‘You again?’ 🤦‍♂️


#StatusUpdate #DevLife #QACommunity #SoftwareTesting #ManualTesting #AutomationTesting #ProjectManagement #Teamwork #ITLife #DailyStandup #TaskTracking #CommunicationInTech #DevAndQA #WorkHumor #TechMemes #Collaboration #TeamCommunication #Agile #SprintLife #OfficeHumor

🎯 Gamification is more than just points and badges!
Do you want to make tasks fun and motivating – even those that are boring or routine? 😎

At our meetup, Anastasia Desyatnichenko, QA Engineer, will show you how gamification:
✨ Makes work and learning easier and more meaningful;
⚡️ Helps you stay engaged and confident;
🎲 Turns habits and tasks into a game where winning is all about results.

We’ll look at examples from everyday life and the IT sphere and share practical techniques you can start using right away – both in QA and beyond.

🎁 Bonus for offline attendees: the most active participants will receive gifts from the speaker!

🎟 Register here

⏰ Time: 19:00 (Tbilisi time)/16:00 (CET)
🕒 Duration: 1 hour
🗣 Language: English
📍 Offline: Andersen’s office in Tbilisi
💻 Online: The link to the stream will be sent to your email specified in the registration form

Join Andersen IT Community:
📱 QA/AQA Telegram
📱 QA/AQA LinkedIn

🚨 One Security Bug Can Cost a Company $1 Billion

Security testing is often seen as just another QA task.
But one vulnerability can destroy years of business growth.

Real examples:

• Equifax breach (2017) — 147M personal records exposed.
Total cost: $1.4B.

• T-Mobile breach (2023) — 37M customers affected.
Cost: hundreds of millions in penalties.

The scary part?
Many incidents happen because of OWASP Top 10 vulnerabilities.

🔓 Broken Access Control (#1 OWASP risk)
Users access data or actions they should never see.

Simple manual checks:
✔️ Modify IDs (user_id, order_id, invoice_id)
✔️ Test horizontal privilege escalation
✔️ Test vertical privilege escalation
✔️ Try protected API endpoints without authorization
✔️ Change HTTP methods (GET → POST → DELETE)

Many critical issues can be discovered with simple manual testing.

💬 What is the most interesting security bug you’ve found?

Full post on LinkedIn 🔗

#QA #CyberSecurity #SecurityTesting #OWASP #SoftwareTesting

No serious content on Mondays