Engineering Blueprint
Test & Audit Everything
QA testing, security audits, and performance benchmarks
What problem does this solve?
Automates testing and compliance so you catch bugs before users do. /qa tests your app (or specific pages from your diff), finds bugs, auto-fixes them with regression test generation, and re-verifies. /qa-only reports bugs without code changes. /cso runs OWASP Top 10 + STRIDE security audits with high-confidence findings only (false positive exclusions built in). /benchmark measures Core Web Vitals and page load times, compares before/after on every PR.
How does it work?
Run /qa against your staging URL (or a branch URL in Conductor). It explores your app, fills forms, tests flows, finds bugs, fixes them with atomic commits (one per bug), generates regression tests, re-verifies. For security: run /cso to scan for injection, broken auth, sensitive data leaks, XSS, and threat model via STRIDE. For performance: run /benchmark before a PR to establish baseline, then after to see impact. Output: tested, audited, verified code before it reaches production.
Key Features
/qa
Browser-based testing with diff-awareness (targets affected pages), auto-fix + regression test generation, re-verification. Authenticated pages via /setup-browser-cookies.
/qa-only
QA report without code changes. Pure bug report for review before you decide to fix.
/cso
OWASP Top 10 + STRIDE threat model audit. Injection, auth, crypto, access control. Zero-noise: false positive exclusions + high-confidence gate.
/benchmark
Core Web Vitals, page load times, resource sizes. Baseline + compare before/after. Tracks trends across PRs.
About This Blueprint
- Industry
- Technology
More Blueprints to explore
ICP-Filtered Outreach Lists from G2 Buyer Intent
Stop wasting rep time on weak intent signals and mismatched accounts. The workflow ranks ICP-fit buyers by readiness, finds the right contact, and supplies tailored outreach angles for the strongest opportunities.
Ishani D.
Account Manager at G2