testland/exploratory-testing
Plans and runs time-boxed exploratory testing when tester hours are scarce before a release - one tester with two free 45-minute blocks before code freeze, a high-stakes window such as year-end payroll, or a device and environment the scripted suite never touches. Session-based per the Bachs' SBTM: charters (Explore X with Y to discover Z), 60-90 minute sessions, session sheets with TBS metrics, and the PROOF debrief. Bundles the exploration heuristics as references - Whittaker's seven tours, Kelly's FCC CUTS VIDS, Bach's SFDPOT. Broader than exploratory-charter-author, which writes one charter document: this owns the whole cycle from budgeting the available hours to debriefing what was found. Use when deciding what to explore with the time available, and how to run and record those sessions.
97
94%
Does it follow best practices?
Impact
98%
1.00xAverage score across 10 eval scenarios
Passed
No findings from the security scan
session-sheet-and-metrics.mdreferences/
SBTM session sheet + metrics in full
Deep reference for exploratory-testing SKILL.md. Consult when authoring or
reviewing a session sheet, or building the cross-session dashboard. Holds the
canonical sheet template, the TBS time-breakdown, and the dashboard metrics.
The session sheet
Each session produces a session sheet. Bach's canonical structure (satisfice.com):
# Session sheet - YYYY-MM-DD - <tester>
## Charter
Explore <area> with <tools> to discover <information>.
## Areas
- (system area 1)
- (system area 2)
- ...
## Session start / duration / setup time / focus
- Started: 14:00
- Duration: 90 min
- Setup time: 10 min
- Charter time: 70 min
- Bug-investigation time: 10 min
- Opportunity time: 0 min
## TBS metrics (time-breakdown)
- Test design + execution: 70%
- Bug investigation + reporting: 11%
- Setup / overhead: 11%
- Opportunity: 0%
- Idle / interruption: 8%
## Data files
- screenshots/2026-05-20-14-15.png
- har/2026-05-20-14-22.har
## Test notes
(narrative of what was tested, in tester's own words; includes
tours applied, heuristics applied, hypotheses formed)
## Bugs (file later)
- B-001: Promo "STACK50" applies after tax instead of before;
reproduces 3/3. Captured at 14:35.
- B-002: Empty cart + apply promo → page error, not graceful message.
## Issues (meta - testing-process problems)
- Cannot get to step 4 in flow without a paid customer account;
test data unavailable. Blocking 40% of charter scope.
## PROOF debrief
(See debrief.md)TBS metrics - time breakdown
Per Bach's SBTM paper, sessions decompose into:
| Category | Definition |
|---|---|
| T (Test) | Time spent on test design + execution per the charter |
| B (Bug) | Time spent investigating + reporting bugs |
| S (Setup) | Time setting up the environment / test data / tools |
Plus often-included:
- Opportunity: unrelated bugs found by chance; investigated outside charter scope
- Idle: waiting on a build / response
Healthy session: T 60-80%, B 10-20%, S 10-15%. Skewed sessions (T < 50%) signal problems - environment instability, charter too broad, etc.
Dashboard metrics - across sessions
Per Bach's SBTM Reporting paper (satisfice.com), the lead views:
| Metric | What it tells |
|---|---|
| Sessions per week | Throughput |
| Avg T% across sessions | Environment / charter-scope health |
| Bugs per session | Find rate (interpret carefully - not all sessions should find bugs) |
| Charters complete / in-progress / blocked | Coverage progress |
| Charter-to-bug ratio | Quality of charter framing (too broad = many small bugs; too narrow = few) |
These feed the testing-strategy review at sprint planning.
Charter examples
A charter states the mission for one session (Explore <area> with <tools> to discover <information>). Sample charters:
| Charter |
|---|
| "Explore the cart promo-stacking flow with manual sample inputs to discover discount-application bugs." |
| "Explore the password-reset endpoint with the OWASP Top 10 list to discover injection / SSRF vulnerabilities." |
| "Explore the checkout error states with a flaky-network proxy to discover retry behaviour issues." |
| "Explore the admin dashboard's role-permission UI with three test users to discover authorization-leak bugs." |
Worked example - one 90-minute session
**Charter:** Explore the cart promo-stacking flow with manual sample
inputs to discover discount-application bugs.
**Timings:** Started 14:00; 90 min; 10 min setup; 70 min charter;
10 min bug investigation.
**Bugs:** B-001 - "STACK50" applies after tax instead of before,
reproduces 3/3.
**Issues:** Cannot reach step 4 without a paid account; blocks ~40%
of charter scope.
**TBS:** T 70% / B 11% / S 11% / Idle 8% - healthy.
**PROOF Outlook:** recommend a follow-up charter for tax-jurisdiction
promos.Result: the session sheet is filed and reviewed within 24h; the lead schedules the follow-up charter and provisions a paid test account to unblock the Issue.