SDET & QA Interview Questions

Data-driven frameworks run the same test logic against many input rows. Keyword-driven frameworks describe steps as reusable keywords, often in tables. BDD writes behaviour as Given/When/Then scenarios shared with the business. Most real frameworks are hybrids: code-first tests, parameterized data and page objects.

Both are pipeline-as-code in a Jenkinsfile. Declarative has a fixed, validated structure (pipeline, agent, stages, steps, post) and is the default choice. Scripted is plain Groovy, more flexible but harder to read and maintain. Use declarative and drop into a script block only when you must.

A Browser is a launched browser instance. A BrowserContext is an isolated, incognito-like session with its own cookies, storage and cache, and is cheap to create. A Page is a tab in a context. Playwright Test gives each test a fresh context, and extra contexts enable multi-user tests.

INNER JOIN returns only rows with a match in both tables. LEFT JOIN returns every row from the left table plus matches, with NULLs where none exist; RIGHT is the mirror. FULL OUTER returns all rows from both sides. LEFT JOIN with WHERE right.id IS NULL finds rows with no match, a common data check.

A Pod is the smallest deployable unit: one or more containers sharing network and storage. A Deployment keeps a desired number of identical Pods running and handles rolling updates. A Service gives those changing Pods a stable DNS name and load-balances traffic across them.

given() builds the request (base URI, headers, auth, params, body), when() sends it with an HTTP method, and then() validates the response with status, header and Hamcrest body matchers using GPath. Use extract() to pull values out for later steps.

Use LLM assistants to draft test ideas, boundary cases, test data, boilerplate and first-pass code, then review everything as if a junior wrote it: check against the requirements, run it, and make sure assertions are meaningful. Never paste secrets or customer data into tools your company hasn't approved.

Selenium drives the browser from outside via the WebDriver protocol. Cypress runs test code inside the browser next to the app, with a Node.js process for tasks and network proxying. That gives automatic retries, network control and time-travel debugging, at the cost of multi-tab and cross-origin limits.

Your test calls the language binding, which sends W3C WebDriver commands as HTTP requests to a browser driver (chromedriver, geckodriver), which controls the real browser. Selenium Manager downloads matching drivers automatically, and WebDriver BiDi adds a two-way channel for events.

Postman resolves variables from the narrowest scope outward: local, data (iteration), environment, collection, global. Use environments for per-stage values like baseUrl and credentials, collection variables for values shared by the collection, and keep secrets out of shared initial values.

var is function-scoped, hoisted and initialised to undefined, and can be redeclared. let and const are block-scoped and hoisted but sit in the temporal dead zone until declared. const prevents reassignment of the binding, not mutation of the object it points to. Default to const, use let when reassigning.

An image is a read-only, layered template built from a Dockerfile; a container is a running instance of it with its own writable layer. For testing, Docker gives reproducible environments: the same browser, runtime and dependencies locally and in CI, disposable databases and services, and easy parallel isolation.

Both describe object shapes and are mostly interchangeable. Interfaces can be reopened through declaration merging and extended with extends; type aliases can name any type, including unions, tuples, primitives, mapped and conditional types. Many teams use interfaces for object contracts and types for everything else.

git fetch downloads new commits and updates remote-tracking branches like origin/main without touching your working branch. git pull runs a fetch and then integrates the changes into the current branch, by merge by default or by rebase if configured. Fetching first lets you inspect before integrating.

Load testing checks expected and peak traffic against agreed targets. Stress testing goes beyond capacity to find the breaking point and how the system fails and recovers. Soak testing holds realistic load for hours to expose leaks. Spike testing applies sudden surges to check scaling and recovery.

Severity is the technical impact of a defect on the system; priority is how urgently the business needs it fixed. They are set by different people for different reasons, so they can diverge: a typo in the company name on the home page is low severity but high priority.

Verification asks 'are we building the product right?': does the work product meet its specification, checked through reviews, static analysis and many tests. Validation asks 'are we building the right product?': does it meet the user's actual needs, checked through UAT, demos, beta and usability testing.

Default values are evaluated once, when the def statement runs, not on each call. A mutable default such as a list or dict is therefore shared across calls and accumulates state. Use None as the default and create the object inside the function. The same applies to defaults like datetime.now().

The OWASP Top 10 is a periodically updated awareness list of critical web app security risks; the 2025 edition runs from broken access control to supply chain failures and mishandled exceptional conditions. QA covers a useful slice with negative tests on authorization, input, auth flows, error handling and headers.

Assert the exact status the contract promises, not just 'is 2xx'. 201 for creation (with Location), 204 for no body, 401 when you are not authenticated, 403 when you are authenticated but not allowed, 400 for malformed input, 422 for well-formed but invalid input, 409 for conflicts, 5xx is always a bug.

Run fast, reliable checks on every pull request (lint, unit, component, API and a small UI smoke set), a broader regression after merge against a deployed environment, and slow or expensive suites (full E2E, cross-browser, performance, security scans) on a schedule or before release.

A String's value cannot change after creation; methods like concat or replace return new objects. Immutability enables the string pool, safe sharing across threads, cached hash codes for HashMap keys, and security. Use StringBuilder when building strings in a loop to avoid creating many intermediate objects.

Understand the service, its users and dependencies, then rank risks. Map each risk to the cheapest test layer that catches it (unit, component, contract, integration, a few end-to-end), plan environments, data and non-functional testing, wire tests into CI with quality gates, and monitor in production.

Latency distributions are skewed with a long tail, so the average hides slow requests and is pulled around by outliers. p95 means 95% of requests were at or below that value. Percentiles describe what real users experience, and tail latency (p99) matters because one page triggers many requests.

Smoke testing is a shallow, broad check that a build is stable enough to test at all. Sanity testing is a narrow, focused check that a specific fix or change works. Regression testing re-checks existing functionality to make sure recent changes did not break it, and is the main target for automation.

A conflict happens when both branches changed the same lines or one deleted a file the other edited. Run git status to list conflicted files, edit each to combine the changes and remove the markers, run tests, then git add and continue the merge or rebase. Use --abort to back out safely.

Post-response scripts use pm.test with Chai-style pm.expect assertions on status, headers, body and response time. Chain requests by extracting values such as ids or tokens from one response into variables, then referencing them as {{var}} in later requests; pre-request scripts prepare data or fetch tokens.

An abstract class can hold state, constructors and implemented methods, and a class extends only one. An interface defines a contract with no instance state; since Java 8 it can have default and static methods, and a class can implement many. WebDriver is an interface; BasePage is often abstract.

PUT replaces the whole resource at a known URI and is idempotent; PATCH applies a partial change and is not guaranteed idempotent; POST creates or triggers actions and is not idempotent. Idempotent means repeating the same request leaves the server in the same state as sending it once.

*args collects extra positional arguments into a tuple and **kwargs collects extra keyword arguments into a dict. The same operators unpack sequences and dicts into calls. They are used for wrappers and decorators that forward arguments, and for builders that accept field overrides.

=== compares without type conversion; == applies type coercion first, giving surprises like 0 == '' being true. Both compare objects by reference, not content, so two identical objects are not equal. In tests use deep equality such as toEqual or toStrictEqual, and use Object.is semantics for NaN and -0.

Prefer user-facing locators: getByRole with an accessible name first, then getByLabel, getByPlaceholder or getByText, and getByTestId for elements with no stable accessible identity. Avoid CSS or XPath tied to DOM structure. Locators are lazy, strict, and re-resolved on every action, which makes them resilient.

A good bug report lets someone who has never seen the issue reproduce it on the first try: a specific title, environment, minimal numbered steps, expected versus actual result, evidence such as screenshots, logs or a HAR, and an honest severity. One defect per report.

Prefer stable, unique attributes: id or a dedicated data-testid via CSS. Use CSS selectors for most cases and XPath only when you need text matching or DOM traversal CSS can't do. Avoid absolute XPath and styling classes, and agree test IDs with developers.

Partial, Required, Pick, Omit, Record, Readonly, ReturnType and Awaited derive new types from existing ones, so test data builders, API payloads and config stay in sync with the source types. For example Omit<User, 'id'> for a create payload, or Partial<User> for builder overrides.

GROUP BY the email and keep groups with HAVING COUNT(*) > 1. Normalise with LOWER and TRIM if duplicates differ by case or spaces. To see the full duplicate rows, use a window function such as COUNT(*) OVER (PARTITION BY email) or join back to the grouped result.

Build and static checks, unit and component tests, contract tests, image build and scan, deploy to a test environment, API and integration tests, then promotion with smoke tests and canary checks. Each gate is an objective, automated rule, such as new-code coverage or zero critical vulnerabilities.

Broken access control means the server fails to enforce what an authenticated user may do. IDOR is the classic case: changing an ID in a request returns another user's data. Test it with two or more users and roles, swapping identifiers and tokens across every endpoint, and automate those checks as a matrix.

Build reusable specs with RequestSpecBuilder (base URI, content type, auth, filters) and ResponseSpecBuilder (common status, content type, response-time checks), then apply them with given().spec() and then().spec(). Put them in a base class or client layer so tests only express intent.

Have the runner write JUnit XML, publish it in a post { always } block with the junit step, and archive HTML reports, screenshots and traces as artifacts. The junit step marks the build UNSTABLE when tests fail; FAILURE means the pipeline itself broke, such as a compile error or crash.

Package the tests as an image and run them as a Kubernetes Job, with config from ConfigMaps and Secrets, resource requests and limits, backoffLimit 0 so failures are not silently retried, and results shipped out as artifacts. For isolation, deploy the app into an ephemeral namespace per pull request.

Start from a pinned base image that already has the browsers or runtime you need, copy dependency manifests first and install so the layer is cached, then copy the test code. Run as a non-root user, keep secrets out of the image, pass config at runtime, and write reports to a mounted directory.

Generated tests can look correct while asserting little, encode current buggy behaviour as expected, hallucinate APIs, ignore framework conventions, add flaky waits and duplicate coverage, and leak data into external tools. Mitigate with review, mutation-style checks that tests can fail, linting, and clear ownership.

Separate concerns: tests that read like scenarios, a domain or flow layer, interaction layers (page or component objects, API clients), core utilities (driver lifecycle, config, data builders, waits), and reporting. Dependencies point downward only, so a UI change touches one page object, not hundreds of tests.

Cypress commands are not promises. Calling cy.get() enqueues a command and returns a chainable immediately; Cypress runs the queue later with retries. Use .then() to work with yielded values, aliases to share them, and cy.wrap() for real promises, instead of await.

Focus on money-correctness risks: idempotency and duplicate charges, state machine transitions, amounts and currency rounding, failure and timeout handling with the payment provider, reconciliation, security and compliance. Use provider stubs and sandboxes, contract and concurrency tests, and production reconciliation.

Equivalence partitioning groups inputs the system should treat the same, so one value per partition is enough. Boundary value analysis tests the edges of each partition, where off-by-one defects cluster. For an age field accepting 18 to 60, test 17, 18, 60, 61 plus valid and invalid representatives.

Clarify requirements first, then cover functional cases (valid, invalid, empty, case sensitivity), validation and error messages, security (lockout, generic errors, HTTPS, password masking, injection), session behaviour, usability and accessibility, and cross-browser or mobile checks. Prioritise by risk.

An implicit wait makes every findElement poll for presence up to a timeout. Explicit waits (WebDriverWait) wait for a specific condition such as visibility or clickability. FluentWait is the configurable base with polling interval and ignored exceptions. Mixing implicit and explicit waits causes unpredictable timeouts.

Check the status, then headers (Content-Type, caching, Location), the body's schema (types, required fields), the actual values against the request and business rules, error formats for negative cases, response time, and side effects such as the database or a follow-up GET.

any switches off type checking and spreads silently. unknown accepts any value but forces you to narrow it before use, which makes it the safe type for JSON, caught errors and external input. never is the type with no values, used for impossible states and exhaustive checks on unions.

If two objects are equal by equals(), they must return the same hashCode(); unequal objects may share a hash. Hash-based collections find the bucket by hashCode and then compare with equals, so overriding only equals makes HashSet and HashMap lookups fail. Records and Objects.hash make correct implementations easy.

Use DENSE_RANK() OVER (ORDER BY salary DESC) and filter rank = N; add PARTITION BY department for per-group results. Alternatives are a MAX subquery for the second highest, or SELECT DISTINCT with ORDER BY, LIMIT 1 OFFSET N-1. Clarify how ties and NULLs should be handled.

Fixtures are functions decorated with @pytest.fixture that pytest injects into tests by parameter name. Scope (function, class, module, package, session) controls how often they are created. Code after yield is teardown. conftest.py shares fixtures across a directory without imports.

When a locator fails, the tool compares the element's stored attributes (id, text, classes, position, neighbours) with candidates on the page, scores similarity and uses the best match, sometimes updating the locator. Risks: clicking the wrong element, masking regressions and unreviewed drift.

Derive it from production data: peak arrival rate, the mix of user journeys and their proportions, think time, data variety and session behaviour. Use an open model (fixed arrival rate) for public traffic and a closed model (fixed concurrent users) for bounded user groups, and agree targets up front.

Attach a CSV or JSON data file to a collection run; each row or object becomes one iteration, and its fields are available as {{column}} in requests and via pm.iterationData.get() in scripts. Include expected results in the file so the same request covers positive and negative cases.

Pass a POJO or Java record to body() and REST Assured serializes it with Jackson (or Gson) found on the classpath; use extract().as(Type.class) or a TypeRef for generics to deserialize. Control mapping with Jackson annotations and decide deliberately whether unknown fields should fail tests.

Prefer each test creating the data it needs through APIs or builders, with unique values so tests can run in parallel and in any order. Keep shared seed data read-only, clean up or use disposable environments, never rely on production copies with real personal data, and keep data creation out of the UI.

Both happen when untrusted input is interpreted as code. For SQL injection, probe inputs with quotes and boolean or time-based payloads and watch for errors or changes. For XSS, inject markup in every input and check it is encoded where it is rendered. Back this with scanners, code review and parameterized queries.

Register cy.intercept before the action that triggers the request, alias it, then cy.wait('@alias') to synchronise and assert on the request and response. Pass a response or fixture to stub it, or use a handler with req.reply / req.continue to modify traffic. Keep some tests unstubbed end to end.

Define the app, its database and dependencies, and the test runner as services in compose.yaml. Use healthchecks with depends_on condition service_healthy so tests start only when services are ready, address services by name on the Compose network, and run with docker compose up --abort-on-container-exit.

Merge joins histories with a merge commit and rewrites nothing. Rebase replays your commits on a new base, producing a linear history but new commit SHAs. Never rebase commits others have based work on, such as a shared branch or main; rebase your own local feature branch, and merge into shared ones.

Web-first assertions such as expect(locator).toHaveText() take a locator and retry until the condition is met or the expect timeout (5 seconds by default) expires. Reading a value first with await locator.textContent() takes one snapshot and asserts immediately, so it fails on content that is still loading.

A closure is a function bundled with references to the variables of the scope where it was created, so it can still read and update them after that scope has returned. Closures power private state, factories, callbacks and memoisation, and explain the classic var-in-a-loop bug.

Trigger on pull_request and push, use a matrix to split the suite into shards, cache dependencies through setup-node or setup-java, set fail-fast false so every shard reports, and upload reports and traces with actions/upload-artifact@v4 under if: always() and a unique name per shard.

Test each service in isolation against its events (consume and produce), use contract or schema compatibility checks for messages, run integration tests with a real broker in containers, and keep a few end-to-end flows that poll for outcomes. Test duplicates, ordering, retries, dead-letter queues and observability.

Split the suite into shards, run each shard in a parallel stage on its own agent (labels or Kubernetes/Docker agents), stash the build once and unstash it per shard, publish every shard's JUnit XML, and use failFast deliberately. Balance shards by historical duration and keep tests independent.

Deploy Grid 4 in hub-and-node or distributed mode, typically with the official docker-selenium Helm chart. Browser nodes run as pods, and KEDA's Selenium Grid scaler scales them from the session queue, often to zero. Size resources and shared memory, drain nodes after a session, and watch queue time.

Checked exceptions extend Exception and must be caught or declared; unchecked ones extend RuntimeException. In a framework, let unexpected exceptions fail the test, wrap low-level checked exceptions in meaningful unchecked ones with the cause kept, use try-with-resources, and never swallow exceptions.

JavaScript runs one call stack; when it empties, the event loop drains microtasks (promise callbacks) and then runs the next macrotask (timers, I/O). forEach ignores the promise an async callback returns, so nothing awaits it. Use for...of for sequential work or Promise.all with map for parallel.

Keep one typed config object loaded in a clear precedence order: defaults, then an environment file selected by a single variable, then environment variables or CLI overrides. Never commit secrets; inject them from the CI secret store or a vault at runtime, mask them in logs, and fail fast on missing values.

It means the element reference points to a node that was removed or re-rendered. Re-locate the element after the DOM changes instead of caching WebElements, wait for the new state with WebDriverWait, and use Page Objects that find elements lazily.

Export the collection and environment (or reference them by UID via the API), run them with Newman (npm) or the Postman CLI in a pipeline step, inject secrets with --env-var from the CI secret store, emit JUnit XML for the CI test report, and let the non-zero exit code fail the build.

Know the style first (offset/limit or cursor). Then test page size defaults and limits, first/last/empty pages, invalid parameters, metadata and links, no duplicates or gaps when walking all pages, stable ordering with ties, and what happens when data changes between page requests.

git revert creates a new commit that undoes an earlier one, so it is safe on shared branches. git reset moves the branch pointer back, with --soft, --mixed or --hard deciding what happens to staged and working changes; use it only on unpushed commits. git restore discards file changes. git reflog recovers mistakes.

Before acting, Playwright waits for actionability checks (attached, visible, stable, receives events, enabled, editable as relevant). Web-first assertions retry until timeout. It is not enough for app-level state like background jobs or data that changes without a DOM signal.

With testIsolation on (the default), Cypress clears cookies, localStorage, sessionStorage and the page before each test, so tests can't depend on each other. cy.session() caches and restores a logged-in session per id, with a validate callback, so you log in once (ideally via API) without sharing state.

Write request helpers like get<T>(path): Promise<T> so callers state the expected response type, or better, map endpoints to request and response types in one interface and use keyof plus indexed access types so the path determines the types. Remember generics are compile-time only: validate at runtime too.

A decorator is a function that takes a function and returns a wrapper. A configurable retry decorator needs three levels: a factory taking options, the decorator, and a wrapper that loops, catches only the listed exceptions, sleeps with exponential backoff, and re-raises after the last attempt. Use functools.wraps.

An AI test agent is an LLM in a loop that calls tools, such as a browser exposed through the Model Context Protocol (Playwright MCP). It helps explore apps, reproduce bugs and draft tests, but is still experimental as an unsupervised gate: nondeterministic, costly and needing review.

Exploratory testing is simultaneous learning, test design and execution, guided by the tester's judgement rather than pre-written scripts. It becomes accountable through charters, time-boxed sessions, notes, heuristics and a debrief, often called session-based test management.

The test pyramid recommends many fast, isolated unit tests, fewer integration or service tests, and a small number of slow end-to-end UI tests, to get fast, reliable feedback cheaply. The principle still holds, but the shape is a heuristic: the testing trophy and honeycomb shift weight to integration tests.

Define scenarios with an executor such as ramping-arrival-rate, use checks to validate responses without stopping the test, and set thresholds on metrics like p(95) of http_req_duration and http_req_failed so the run exits non-zero in CI when targets are missed. Tag requests to get per-endpoint results.

Layer fast checks early and slower ones later: secrets scanning and SAST on every pull request, dependency (SCA) and container image scanning on build, DAST against a deployed environment, plus automated authorization tests. Gate on new high-severity findings and baseline the rest so the gate stays trusted.

Detect flakiness with data (pass-on-retry, history across runs), quarantine flaky tests out of the blocking set with an owner and deadline, fix root causes such as timing, shared data and environment instability, and treat retries as a detection tool rather than a fix. Track the flake rate as a team metric.

Use the json-schema-validator module's matchesJsonSchemaInClasspath to assert the response contract, kept in sync with the OpenAPI spec. Use filters (implementing Filter) for cross-cutting concerns: auth token injection and refresh, request/response logging on failure, correlation ids, and attaching traffic to reports.

Compare source and target with row counts, checksums or aggregates, and row-level diffs using EXCEPT. Check orphans with NOT EXISTS, duplicates on business keys, NULLs in required columns, invalid values and broken totals. Beware the NOT IN with NULL trap, and automate the checks so they run on every load.

It means verifying behaviour in the real environment with controls that limit blast radius: feature flags, canary and progressive rollouts gated on metrics, synthetic monitoring of critical journeys, post-deploy smoke checks, and observability. It complements pre-production testing; it never replaces it.

Testcontainers is a library that starts real dependencies such as Postgres, Kafka or Redis in throwaway Docker containers from test code, with wait strategies and random ports. Use it for integration tests that need real behaviour; trade-offs are Docker availability in CI, startup cost and container reuse strategy.

Stay factual: re-verify on the latest build, isolate the environment or data difference, add evidence such as logs, network traces and a video, and reference the requirement. If it is a disagreement about expected behaviour, take it to the product owner rather than arguing. Pair with the developer when possible.

Promise.all fulfils with all results or rejects on the first failure. allSettled waits for every promise and reports each outcome. race settles with the first promise to settle, success or failure. any fulfils with the first success and rejects with an AggregateError only if all fail.

Fixtures are on-demand setup and teardown units injected by name into tests. Create them with test.extend: code before await use(value) is setup, after it is teardown. They can be test- or worker-scoped, depend on other fixtures, run automatically with auto: true, and replace beforeEach hooks and base classes.

A Page Object wraps one page or component: private locators, public methods that express user intent, and no assertions about business rules. Many teams avoid PageFactory because its proxies cache poorly with dynamic DOMs, hide waits and add little over plain By locators.

Test authentication (missing, malformed, expired, wrongly signed tokens give 401) separately from authorization (each role and scope only reaches what it should, 403 or 404 otherwise). For JWTs, check signature, exp, audience and alg handling; for OAuth, test token acquisition, scopes, refresh and revocation.

Group with Collectors.groupingBy(Function.identity(), Collectors.counting()) and keep entries with a count above one. For just the duplicate values, add to a HashSet and collect elements whose add returns false. Explain complexity, ordering (LinkedHashMap) and when a plain loop is clearer.

Use git bisect: mark a known bad commit and a known good one, and Git binary-searches the range, so 200 commits need about eight checks. Automate it with git bisect run and a script that exits 0 for good, 1 for bad and 125 to skip untestable commits. Make the check deterministic first.

First reduce what must run as UI tests by pushing checks down to API and component level. Then make every test independent with API-based setup and reused auth state, shard across many parallel workers on scalable infrastructure, balance shards by historical duration, and track flaky and slow tests as defects.

Isolation levels (Read Uncommitted, Read Committed, Repeatable Read, Serializable) trade concurrency for protection against dirty reads, non-repeatable reads, phantoms and lost updates. Test races with truly concurrent check-then-act requests and verify constraints or locking prevent duplicates.

Automate checks that are repeated often, deterministic, stable in requirements, high-risk, data-heavy or tedious, at the lowest layer that catches the defect. Keep humans on exploratory, usability, one-off and fast-changing areas. Weigh build and maintenance cost against how often the test gives useful feedback.

Reproduce and classify the failure, then fix the cause: understand which commands retry (queries and assertions) and which don't (actions, .then), avoid detached-DOM errors by re-querying after re-renders, synchronise on network aliases not cy.wait(ms), isolate data, and use test retries only as a signal, not a cure.

Test the deterministic parts (retrieval, tools, auth, UI, APIs) conventionally, and evaluate model behaviour statistically on a versioned golden dataset with rubrics, automated graders and human review. Add safety and prompt-injection tests, regression evals on every change, and production monitoring.

Confirm the load generator is not the limit, then correlate the latency curve with server telemetry using the USE method: CPU, memory and GC, thread and connection pools, database queries and locks, downstream calls. Use APM traces to see where time goes, change one thing, and re-test.

Types are erased on compilation, so res.json() as User is a cast, not a check. Validate at the boundary with a schema library such as Zod or JSON Schema with Ajv, infer the static type from the schema so there is one source of truth, and fail the test with a readable error when the contract drifts.

In CPython the Global Interpreter Lock lets only one thread execute Python bytecode at a time, so threads help I/O-bound work but not CPU-bound work. Use asyncio or threads for I/O, multiprocessing for CPU. pytest-xdist runs tests in separate processes. Python 3.13+ offers an experimental free-threaded build.

Log in once in a setup project, save cookies and local storage with storageState to a file, and have test projects depend on that setup and load the file via use.storageState. Prefer API login for speed, use one account per worker if tests mutate server-side state, and keep auth files out of git.

Layer methods: deterministic checks for format and required facts, reference-based metrics (exact match, BLEU/ROUGE, embedding similarity), LLM-as-judge with rubrics and controls for its known biases, and human review. Run them on a versioned golden dataset as regression evals on every change.

Never share a WebDriver between threads. Give each thread its own driver via ThreadLocal or injection scoped per test, avoid static mutable state, and isolate test data. ThreadLocal stores a separate value per thread, but you must call remove() in teardown because thread pools reuse threads.

Give every test its own WebDriver session (ThreadLocal or framework-managed per-test instances), never share static drivers or mutable state, make test data independent, configure parallelism in TestNG or JUnit 5, and run against Selenium Grid or containers sized to the thread count.

Start with a clear reason and a measured baseline, prove value with a pilot, then migrate incrementally while both suites run. Prioritise high-value and flaky tests, rewrite rather than transliterate (auto-waiting locators, fixtures, API setup), delete low-value tests, and retire the old suite in planned stages.

Coverage shows what code was executed, not what was verified, so it finds untested areas but cannot prove tests are good. Better signals combine mutation score, escaped defects, flakiness rate, feedback time and coverage of risks and requirements. Use metrics to ask questions, not as targets.

Use risk-based testing: estimate likelihood and impact of failure per area using what changed, business criticality, usage, defect history and complexity. Test the highest risks deeply, smoke the rest, lean on automation, and make residual risk explicit so stakeholders can make an informed go/no-go decision.

Consumers record the interactions they actually rely on as contracts (for example with Pact); the provider replays them against its real code. Schema validation only checks a response matches a spec. Contracts catch breaking changes for real consumers before deploy, without a shared end-to-end environment.

Wrap the async function in a loop that awaits it, catches errors, decides whether the error is retryable, waits base * 2^attempt plus random jitter, caps the delay, and rethrows the last error after max attempts. Retry only idempotent, transient failures, and never use retries to hide real test flakiness.

Use page.route or context.route with a URL pattern, then route.fulfill to return a mock, route.continue to modify the request, or route.fetch to patch the real response. Mock error states, edge cases and unstable third parties, but keep some unmocked end-to-end tests to catch contract drift.

Grid 4 splits the hub into components: the Router receives requests, the Session Queue holds new-session requests, the Distributor matches them to Nodes by capabilities, the Session Map records which Node owns each session, and an Event Bus connects them. It runs as standalone, hub-and-node or fully distributed.

For rate limits, send a controlled burst and assert 429 with Retry-After at the documented threshold, per key, then recovery after the window. For concurrency, fire truly parallel requests at shared state (stock, balances, unique fields) and assert invariants, optimistic locking (409/412) and idempotency keys.

Playwright runs test files in parallel worker processes; fullyParallel also splits tests within a file. Each worker has its own browser and each test a fresh context. Scale out with --shard=x/n in a CI matrix, the blob reporter and merge-reports. Tests must be independent with isolated data.

Collect evidence first: traces on retry, screenshots, video. Reproduce with --repeat-each and different worker counts. Classify the cause (timing, data, isolation, environment, real product race) and fix it with web-first assertions, isolated data and explicit signals. Track and quarantine; never just add retries.