testland/exploratory-testing

Session-based exploratory testing per the Bachs' SBTM: authoring charters (Explore X with Y to discover Z), running time-boxed sessions (60-90 min), logging session sheets with TBS metrics, and closing with the PROOF session debrief (Past, Results, Outlook, Obstacles, Feelings). Bundles the classic exploration heuristics as references: Whittaker's seven test tours (Feature, Money, Landmark, Intellectual, Bad-data, Configuration, Garbage collector's), Kelly's FCC CUTS VIDS recon tours, Bach's SFDPOT what-to-vary catalog, Bolton's HICCUPPS-F oracle heuristic, and Bach's CRUSSPIC STMPL quality criteria - plus a ready-to-fill charter-card template and a session-sheet review checklist. Use when planning, chartering, running, debriefing, or reviewing an exploratory testing session, or when picking a test tour, heuristic, or oracle mid-session. For scripted manual test cases, use manual-test-script-author instead.

Quality

97%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

SBTM session sheet + metrics in full

Name: testland/exploratory-testing
Rating: 77.60000000000001 (1 reviews)
Author: testland

Deep reference for exploratory-testing SKILL.md. Consult when authoring or reviewing a session sheet, or building the cross-session dashboard. Holds the canonical sheet template, the TBS time-breakdown, and the dashboard metrics.

The session sheet

Each session produces a session sheet. Bach's canonical structure (satisfice.com):

# Session sheet - YYYY-MM-DD - <tester>

## Charter

Explore <area> with <tools> to discover <information>.

## Areas

- (system area 1)
- (system area 2)
- ...

## Session start / duration / setup time / focus

- Started: 14:00
- Duration: 90 min
- Setup time: 10 min
- Charter time: 70 min
- Bug-investigation time: 10 min
- Opportunity time: 0 min

## TBS metrics (time-breakdown)

- Test design + execution: 70%
- Bug investigation + reporting: 11%
- Setup / overhead: 11%
- Opportunity: 0%
- Idle / interruption: 8%

## Data files

- screenshots/2026-05-20-14-15.png
- har/2026-05-20-14-22.har

## Test notes

(narrative of what was tested, in tester's own words; includes
tours applied, heuristics applied, hypotheses formed)

## Bugs (file later)

- B-001: Promo "STACK50" applies after tax instead of before;
  reproduces 3/3. Captured at 14:35.
- B-002: Empty cart + apply promo → page error, not graceful message.

## Issues (meta - testing-process problems)

- Cannot get to step 4 in flow without a paid customer account;
  test data unavailable. Blocking 40% of charter scope.

## PROOF debrief

(See debrief.md)

TBS metrics - time breakdown

Per Bach's SBTM paper, sessions decompose into:

Category	Definition
T (Test)	Time spent on test design + execution per the charter
B (Bug)	Time spent investigating + reporting bugs
S (Setup)	Time setting up the environment / test data / tools

Plus often-included:

Opportunity: unrelated bugs found by chance; investigated outside charter scope
Idle: waiting on a build / response

Healthy session: T 60-80%, B 10-20%, S 10-15%. Skewed sessions (T < 50%) signal problems - environment instability, charter too broad, etc.

Dashboard metrics - across sessions

Per Bach's SBTM Reporting paper (satisfice.com), the lead views:

Metric	What it tells
Sessions per week	Throughput
Avg T% across sessions	Environment / charter-scope health
Bugs per session	Find rate (interpret carefully - not all sessions should find bugs)
Charters complete / in-progress / blocked	Coverage progress
Charter-to-bug ratio	Quality of charter framing (too broad = many small bugs; too narrow = few)

These feed the testing-strategy review at sprint planning.

Charter examples

A charter states the mission for one session (Explore <area> with <tools> to discover <information>). Sample charters:

Charter
"Explore the cart promo-stacking flow with manual sample inputs to discover discount-application bugs."
"Explore the password-reset endpoint with the OWASP Top 10 list to discover injection / SSRF vulnerabilities."
"Explore the checkout error states with a flaky-network proxy to discover retry behaviour issues."
"Explore the admin dashboard's role-permission UI with three test users to discover authorization-leak bugs."

Worked example - one 90-minute session

**Charter:** Explore the cart promo-stacking flow with manual sample
inputs to discover discount-application bugs.

**Timings:** Started 14:00; 90 min; 10 min setup; 70 min charter;
10 min bug investigation.

**Bugs:** B-001 - "STACK50" applies after tax instead of before,
reproduces 3/3.

**Issues:** Cannot reach step 4 without a paid account; blocks ~40%
of charter scope.

**TBS:** T 70% / B 11% / S 11% / Idle 8% - healthy.

**PROOF Outlook:** recommend a follow-up charter for tax-jurisdiction
promos.

Result: the session sheet is filed and reviewed within 24h; the lead schedules the follow-up charter and provisions a paid test account to unblock the Issue.