Multi-tenant flows, subscription billing, role permissions, and feature-flag isolation.
- Subscription & billing edge cases
- Role-based access control gaps
- Feature flag isolation failures
- Tenant data leakage
- API rate-limit bypass
Test what the domain.
From checkout coupon stacking to fintech reconciliation drift — every industry has failure modes that generic QA training doesn't cover. These guides do.
Standard QA techniques — equivalence partitioning, boundary value analysis, API contract testing — are domain-agnostic. But the risk landscape is not. A SaaS product fails in ways a healthcare platform never would; a fintech transaction has failure modes an e-commerce checkout doesn't share. Industry-specific QA means knowing which failure modes are distinctive to your domain, why they occur at the business-logic level, and how to build a test strategy that covers them before they reach production.
Multi-tenant flows, subscription billing, role permissions, and feature-flag isolation.
Checkout flows, inventory sync, payment gateways, and promotion logic for online retail.
High-stakes testing for payments, reconciliation, compliance, and financial data accuracy.
Patient-safety-critical testing: EHR accuracy, HIPAA compliance, and clinical workflow integrity.
Seat selection, availability calendars, dynamic pricing, and booking race conditions.
Multi-sided platform testing: seller onboarding, listing accuracy, and transaction trust.
Learning platforms: course progression, assessments, certifications, and accessibility.
LLM-powered features: prompt regression, hallucination detection, and output consistency.
Provably-fair RNG, server-authoritative real-time state, anti-cheat, and gambling regulation.
Firmware OTA, device-cloud sync, offline reconciliation, and sensor-data validity for connected hardware.
DRM license acquisition, adaptive bitrate quality, CDN failover, cross-device resume, and concurrent-stream enforcement for VOD, live, and audio platforms.
Manual QA engineers
Start with the domain overview and key risk areas. Each guide gives you the domain vocabulary and explains the business logic behind each risk — use this to write better exploratory charters and ask sharper questions in sprint planning.
Automation engineers & SDETs
Jump to the test strategy sections for automation priority matrices. Guides flag which risks are high-automation ROI (e.g. billing regression) vs. those that need human judgment (e.g. UX trust signals in marketplace).
QA leads & managers
Use the risk area tables to validate your team's coverage model. Cross-reference with your current test plan to identify gaps — especially around regulatory compliance, data accuracy, and third-party integration failure modes.
Newcomers to a domain
Read the guide top-to-bottom before your first sprint. The domain-context sections assume no prior industry knowledge — they explain why the business cares about each risk before diving into how to test it.
Race condition coverage
Double-booking, double-charge, and inventory oversell bugs share the same root cause: concurrent writes without proper locking. Every domain with real-time state needs dedicated concurrency test scenarios.
Third-party integration resilience
Payment gateways, GDS APIs, EHR systems, and LLM providers all have outage and degraded-response modes. Test your fallback paths as thoroughly as your happy path.
Audit trail completeness
Fintech, healthcare, and marketplace platforms all require immutable audit logs. Verify that every state-changing action is logged with the correct actor, timestamp, and before/after state.
Data accuracy under scale
Aggregation bugs — totals that drift from line items, counters that miss concurrent increments — appear in billing, analytics, and inventory across all industries. Test at scale, not just at unit level.
Regulatory boundary testing
HIPAA, PCI-DSS, GDPR, and local regulations create hard boundaries your application must not cross. Map each regulation to a concrete test condition and keep these tests pinned in CI.
Timezone & locale edge cases
Travel, finance, and EdTech products all have domain-specific timezone sensitivity — DST transitions, month-end rollover, locale-specific date formats. Generate a dedicated timezone test matrix for each domain.
| Industry | Top risk | Hardest to test | Most common bug |
|---|---|---|---|
| SaaS | Tenant data leakage | Feature flag isolation | Permission boundary bypass |
| E-commerce | Inventory race condition | Coupon stacking logic | Tax calculation drift |
| Fintech | Reconciliation drift | Double-charge under load | Currency rounding error |
| Healthcare | Patient data exposure | Clinical data accuracy | Audit log gaps |
| Travel & Booking | Double booking | Timezone + DST handling | Availability sync lag |
| Marketplace | Seller fraud bypass | Commission edge cases | Listing data inconsistency |
| EdTech | Progress tracking loss | Assessment scoring logic | Accessibility regression |
| AI Product | Hallucination in output | Non-deterministic regression | Prompt injection bypass |
Foundations first
New to QA or new to a domain
Automation engineer path
SDETs and automation QA
AI product QA path
Testing LLM-powered features