# Exploratory Testing — Structured Discovery of Bugs

<!-- hint:slides topic="Exploratory testing: exploratory vs scripted, session-based test management, charters, SFDPOT heuristic, and note-taking" slides="5" -->

## Exploratory vs Scripted Testing

**Scripted testing**: Follow predefined steps. Repeatable, good for regressions.
**Exploratory testing**: Simultaneous learning, test design, and execution. You explore based on what you discover. Ideal for finding unknown unknowns.

They complement each other. Use scripted tests for known risks; use exploratory for discovery.

## Session-Based Test Management (SBTM)

James Bach's framework structures exploratory testing into **time-boxed sessions** with clear charters and debriefs.

### Session Structure

- **Charter**: What to explore (1–2 sentences).
- **Time box**: 60–90 minutes typical.
- **Uninterrupted focus**: No meetings, minimal context switching.
- **Notes**: Log what you tried, found, and questions.
- **Debrief**: Summary for the team.

```mermaid
flowchart TD
    A[Define charter] --> B[Start timer]
    B --> C[Explore: try, observe, note]
    C --> D{Time up or scope done?}
    D -->|No| C
    D -->|Yes| E[End session]
    E --> F[Debrief: findings, risks, bugs]
    F --> G[Create bug reports]
```

## Test Charters

A charter guides exploration without prescribing steps. Format:

> **Explore** [target] **with** [resources/tools] **to discover** [information].

### Examples

- Explore the checkout flow with a test credit card to discover payment failure handling.
- Explore the search feature with various input lengths to discover how results are truncated.
- Explore the profile page with different user roles to discover permission gaps.

Charters give direction but not instructions. You decide *how* to explore.

## SFDPOT — A Heuristic for Coverage

Elisabeth Hendrickson's **SFDPOT** helps ensure you don't miss areas:

| Letter | Area | Questions |
|--------|------|-----------|
| **S** | Structure | UI layout, navigation, menus, links |
| **F** | Function | Features work as stated? |
| **D** | Data | Valid, invalid, boundary, empty, special chars |
| **P** | Platform | Browsers, OS, devices, screen sizes |
| **O** | Operations | Install, upgrade, backup, config |
| **T** | Time | Delays, timeouts, dates, concurrent users |

Use SFDPOT to generate charter ideas: "Explore [Structure] of the dashboard to discover layout bugs on narrow viewports."

## Note-Taking During Sessions

Capture:

- **What you did**: Steps, inputs, paths.
- **What you observed**: Bugs, odd behavior, questions.
- **Ideas**: New charters, areas to revisit.

Keep notes lightweight: bullet points, timestamps, screenshots. A session report template:

```
Charter: Explore X with Y to discover Z
Time: 14:00–15:30
Tester: [name]

Exploration notes:
- Tried A → observed B
- Bug: [brief description]
- Question: [unresolved]

Bugs found: 2
Risks: [areas of concern]
```

## Bug Reporting

Good bug reports have:

- **Title**: One-line summary.
- **Steps to reproduce**: Numbered, precise.
- **Expected vs actual**: What should happen vs what did.
- **Environment**: Browser, OS, version.
- **Screenshots/videos**: When helpful.
- **Severity**: Impact and frequency.

```
Title: Search returns no results when query contains &
Steps: 1. Go to /search. 2. Enter "A&B Corp". 3. Click Search.
Expected: Results for "A&B Corp"
Actual: "No results found"
Env: Chrome 120, MacOS
```

## Debrief Sessions

After exploration, share:

- **Findings**: Bugs, risks, positive discoveries.
- **Coverage**: What you did and didn't cover.
- **Charters for next time**: Unfinished areas.
- **Blockers**: What stopped you (e.g., missing access).

Debriefs turn individual exploration into team learning.

## Combining Exploratory with Automated Testing

- **Before release**: Exploratory sessions on new features.
- **After automation**: Exploratory to find what automation misses (UX, edge cases, integration quirks).
- **Charters from automation gaps**: "Explore areas with low e2e coverage to discover risks."

---

## Key Takeaways

1. **Exploratory = learning + designing + executing** — not ad-hoc clicking.
2. **SBTM** — time-boxed sessions with charters and debriefs.
3. **Charters** — "Explore X with Y to discover Z" — guide without scripting.
4. **SFDPOT** — heuristic for broad coverage.
5. **Notes and debriefs** — make exploration visible and actionable.
6. **Combine** exploratory with automated tests for balanced quality.