Pedro Morago

My Quality Assurance knowledge base: 50+ articles, all written by me.

A training and knowledge wiki where I write about what I practice daily as a QA. It isn't an app: it's the side of the craft that shows judgment and depth, not just code. I keep expanding it continuously.

• Testing strategy: backend and frontend layers, microservices and shift-left with a maturity model.
• API testing with REST Assured and JUnit 5: JSON Schema, negative cases and waits with Awaitility.
• Automation with Playwright and TypeScript, including a real migration case from TestCafe.
• CI/CD for QA: static analysis, parallelization and suite sharding, Docker, Git and AWS.
• Performance with JMeter, QA on telecom OSS/BSS, and the ISTQB fundamentals.
• Semantic search that runs entirely in the browser, plus an AI answer button: grounded, cited answers built only from my own articles (RAG on Cloudflare Workers AI).

Optimal parallelization of Cypress suites in CI, without relying on Cypress Cloud.

A tool that analyzes your Cypress run reports and recommends the optimal sharding strategy for your pipeline: it measures current performance, detects imbalances between containers and suggests the exact spec partition that minimizes total execution time, with optimality certification via a branch & bound algorithm.

• Try it in the browser: it opens with a demo run already loaded, and you can drop in your own reports — nothing to install and no account.
• 100 % local, private analysis: reports never leave the browser.
• Three interfaces: interactive web app, CLI with a quality-gate mode, and a local REST API.
• Actionable recommendations: per-container spec lists ready to paste into GitHub Actions or Bitbucket Pipelines.
• Pure core with hexagonal architecture, tested with property-based, metamorphic and invariant tests.

Chrome extension for reporting bugs with full evidence in a single recording.

A browser extension (Manifest V3) that records your screen, window or tab while automatically capturing everything a developer needs to reproduce the bug: console logs synced with the video, uncaught exceptions, network requests as HAR, and numbered user steps. No time limits, no watermark, no account.

• Install it in 30 seconds: download the zip, Load unpacked in chrome://extensions. No store account, no build step.
• Tested against a bench I built for it: bench.pedromorago.com, a page that breaks on demand — a 500 on a write, an uncaught exception, a response that says OK and means the opposite — so the capture could be checked against known failures instead of whatever a real site happened to do.
• QA mode: console, errors, 404s and HAR synced to the video by timestamp.
• Live on-video annotations and keyboard-shortcut markers to flag the exact moment of the bug.
• Automatic step recording (clicks, forms, SPA navigations) exportable as *.steps.md — each step carries a paste-ready Cypress or Playwright selector, so the step list doubles as the skeleton of the regression test. Typed values are never logged.
• Generates the full report and files the issue directly in Jira Cloud or Linear.
• Zero external dependencies: native browser APIs only.

Twin queue apps — one insecure on purpose, one done right — proving why a browser-only access control isn't one.

A matched pair I built to see a security rule fail instead of quoting it. Both look identical — the same virtual waiting room in front of a members' login — but the control lives in opposite places: the vulnerable lab enforces the queue only in the browser, while its secure twin issues a server-signed pass. Same façade, opposite internals, and that contrast is the whole lesson.

• The bug measured, not asserted: with DevTools network throttling the login form stays exploitable for ~180 ms on a fast connection but over 6 s on Slow 3G — the exploitation window is a table, not a hunch.
• Three independent bypasses — block the guard script, edit the cookie, or POST straight to /login — make the point that narrowing the window never closes the hole.
• The secure twin issues a server-signed HMAC-SHA256 pass (Queue-Fair style), with the expiry and User-Agent inside the signature, so those same three tricks come back 403/425.
• Published responsibly: self-contained, localhost or an authorized instance only, prominent warnings, fictitious credentials, no third-party services.
• The QA method made explicit — build the failure you want to detect, then prove the fix defeats it — the same reflex behind my bug bench.