Coverage library

What the spider actually tests.

Not a features list — the real checks that run against products like yours. Every topic below ships as an automated suite: UI flows in a real browser, contracts against the API, re-run on every deploy.

Two depths of coverage

Start at the surface. Go as deep as you trust us.

Surface coverage

Start in minutes · no access needed

Everything the public can reach

Pages, forms, user flows and public APIs — tested from the outside, exactly the way a visitor (or an attacker) sees them. Starts from nothing but a URL.

  • Site-wide crawl & flow map
  • Smoke + regression suites
  • Public API health checks
  • The demo below runs this exact pass

Deep coverage

NDA signed first · full access

Inside the product, under NDA

We plug into your project properly: staging credentials, repositories, internal tools. That is how we reach what surface testing never sees. Every deep engagement starts with a signed NDA.

  • Authenticated & role-based flows
  • REST / GraphQL contract tests
  • Data integrity after mutations
  • Coverage mapped to your actual routes & repos

The library

Every topic ships as a suite.

Auth & sessions

The flows that lock users out when they break — and the ones attackers try first. The spider drives real sign-ins with test accounts and checks every unhappy path.

  • Sign-up with valid / already-used / malformed emails
  • Login, logout, session expiry and refresh
  • Password reset end-to-end, including the email link
  • Redirect back to the intended page after login
  • Rate limiting and error copy on repeated failures

Checkout & payments

Revenue flows get the deepest coverage. Sandbox cards, declined payments, abandoned carts — tested on staging, never against real money.

  • Add to cart → checkout → sandbox payment → confirmation
  • Declined card, expired card and 3DS challenge paths
  • Prices, taxes and totals consistent between pages and API
  • Coupons, empty carts and quantity edge cases
  • Order confirmation email and webhook delivery

API contracts — REST & GraphQL

Most regressions ship in the backend and surface later. Contract checks catch them in seconds, before any UI test would even load.

  • Response shape and status codes for every public endpoint
  • Auth boundaries: expired tokens, missing scopes, other users’ data
  • Error bodies stay machine-readable (no HTML in a JSON API)
  • Pagination, filtering and sorting behave under real data volumes
  • Breaking-change detection against the previous contract

Forms & validation

Every form is a contract with your users. The spider fills them like a hurried human — wrong, empty, pasted and double-submitted.

  • Required-field and format validation, client and server side
  • Double-submit protection and loading states
  • Unicode, emoji and very long input values
  • Error messages point at the actual broken field
  • Success states, redirects and notifications after submit

Roles & permissions

The bugs nobody notices until a customer sees another customer’s data. Role-based checks run as different users against the same resources.

  • Viewer / editor / admin see exactly what they should
  • Direct-URL access to restricted pages is denied
  • API objects owned by other accounts are unreachable
  • Downgraded users lose access immediately

Files & uploads

Uploads fail in creative ways. The spider brings the whole zoo of files.

  • Supported formats upload, render and download intact
  • Oversized and zero-byte files fail with a clear message
  • Wrong extensions and MIME mismatches are rejected
  • Progress, cancel and retry behave under a slow network

Web3 & smart contracts

dApps break in ways classic suites never see — a UI that quietly disagrees with the chain. The spider tests both sides of the bridge, with emulated wallets and no real funds.

  • Wallet connect, network switch and signing — including reject paths
  • Contract calls against testnets and forked mainnet: state, reverts, events
  • Rendered balances and positions match actual on-chain state
  • Gas-estimation failures and pending-transaction UI states
  • Indexer / subgraph consistency with chain events

Performance smoke

Not a load test — a tripwire. The spider tracks response times per page and endpoint and flags regressions against the baseline.

  • Page-load and API latency baselines per route
  • Console errors and failed network requests on every page
  • Payload-size regressions (the accidental 4 MB bundle)
  • Third-party outages detected and excluded from your score

Web2 + Web3

dApps and smart contracts are fair game.

Blockchain products break in ways classic test suites never see. The spider speaks both worlds — same loop, same tracker, same guarantees.

Wallet flows

Connect, network switch, transaction signing — and the reject paths users actually hit. Tested with emulated wallets, no real funds at risk.

Smart contracts

Contract calls exercised against testnets and forked mainnet: state changes, reverts, gas-estimation failures and event emissions.

UI ↔ on-chain truth

The classic dApp bug is a UI that disagrees with the chain. The spider cross-checks rendered balances, positions and history against actual chain state.

From red test to filed ticket

The bug reports itself. Your team just fixes it.

The expensive part of QA is not finding the bug — it is the write-up, the screenshot hunt, the chase to get it in front of a developer. QA Spider closes that loop on its own.

  1. 01

    A test goes red — the bug is already written

    No one has to reproduce it, screenshot it or write it up. The report is drafted the moment the test fails, from what actually happened in the run.

    Steps to reproduce are built from the executed steps · failure screenshot attached · severity P0–P3

  2. 02

    It lands in your tracker, not in a spreadsheet

    One click files it where your developers already work — as a proper ticket, in your project, with the reproduction and the proof attached.

    Jira · Azure DevOps · ClickUp · GitHub Issues · Linear — duplicate-checked before filing

  3. 03

    The right people hear about it immediately

    A failed run or a new bug shows up in your team chat with a link straight to the ticket. Nobody has to watch a dashboard to find out something broke.

    Slack · Discord · Telegram — on failed runs and on filed bugs, quiet when everything is green

  4. 04

    Nothing quietly rots

    Every bug keeps a status until it is genuinely done — so “we fixed that already” is a fact you can check, not a memory.

    Open → in progress → fixed → verified · filter by project, severity and status · screenshot kept with the bug

Runs on your schedule, several times a day

Pick the hours that matter — before standup, after every deploy, overnight. The suite runs itself and you read the result, not the calendar.

You can see whether quality is moving

Pass rate, flakiness and open bugs by severity in one view — the numbers you need for a release call, not a wall of logs.

What a caught bug looks like

What a caught bug looks like

Not a red line in a log — a complete, reproducible ticket with a root cause and a suggested fix, plus the runs that produced it. Here’s a real example of what lands in your tracker.

QA-1042Open · Highfiled to Jira · by QA Spider

Title

Checkout: expired promo code shows “applied” and charges full price

Description

On /checkout, applying an expired promo code shows “Code applied ✓” and charges the full amount. No discount is given and no error is surfaced — the customer is silently overcharged.

Steps to reproduce · STR

  1. Add any item to the cart and open /checkout
  2. Enter the promo code SUMMER24 (expired) and press Apply
  3. Pay with test card 4242 4242 4242 4242

Actual result · AR

“Code applied ✓” badge shown · order total unchanged · full amount charged · no error message.
Expand full ticket — expected result, root cause, fix & screenshot

Expected result · ER

Inline error “This code has expired.” · Apply stays disabled · payment blocked until resolved.

Root cause

Client trusts POST /api/promo returning 200 { valid: true, discount: 0 } for expired codes instead of rejecting them.

Suggested fix

Return 422 code_expired from /api/promo, surface the message inline, and keep the Pay button disabled while a code is invalid.

Screenshot · trace attached

/checkout
Code applied
⚠ total unchanged — $149.00

Recent runs

ProjectEnvResultTime
c(client name hidden)prodpassed214002m 14s
c(client name hidden)stagingbug filed208103m 02s
p(client name hidden)devflaky healed176024m 09s
g(client name hidden)prodpassed88001m 47s

Every deploy · nightly · on demand

Every bug lands like this — deduped, reproducible, with a root cause and a suggested fix — straight in the tracker your team already uses. Developers just fix.

Meet the Helper

Not just a crawler — a QA copilot in your workflow.

Alongside the autonomous spider, the Helper takes a story from your tracker, checks it against your live app criterion by criterion, and writes the QA paperwork around it — plans, cases, checklists, bug reports. You review and approve; nothing touches a production-looking environment without your say-so.

01

Starts from your ticket

Paste a Jira or Azure DevOps link and the Helper pulls the story and its acceptance criteria in. No copy-paste, no re-typing what the ticket already says.

02

Answers “does it actually work?”

Each acceptance criterion becomes a real test and runs against your live app — you get a pass or fail per criterion, not an opinion. Prod-looking environments ask first.

03

Writes the QA paperwork

Test plans, test cases, smoke stories, regression checklists, edge-case sweeps and bug reports — grounded in your product, exportable to Markdown, CSV or Excel for TestRail, Xray or Zephyr.

04

Keeps what proved useful

A story you tested once can be saved into the project as a managed automated test — so tomorrow it runs on schedule with the rest of the suite.

Ticket in · tested on your live app · docs out · saved to the suite

Try the Helper →

Manual QA vs QA Spider

Do the math on your regression pass.

Slide your real numbers in. The spider does the same pass in minutes — on every single deploy.

 Manual QAQA Spider
Regression per releaseThe parts someone had time forEvery flow, every release
Feedback after a deployHours to daysMinutes
Nights & weekendsSomeone clicks through checkout at 11pmThe spider does not sleep
Bug reports"It broke on my machine"Repro steps, screenshot, trace
When the UI changesRe-learn, re-click, re-documentSuite heals itself
Cost as you growScales with headcountFlat per project

Your numbers

Manual hours / month

0 h

Spider runtime / deploy

9 min

Saved / month vs $990 plan

$0

Pays for itself

8.5×

Assumes 20 minutes to execute and document one flow by hand, $990/mo Orb Weaver plan, spider tests running in parallel. Your mileage will vary — that’s what the pilot crawl is for.

Want this list, but for your product?

Drop your URL on the homepage — the spider drafts a coverage plan for your actual pages in about a minute.

Analyze my site →