| name | test-strategy |
| description | Design test strategies including security testing, write test plans, and identify test scenarios for banking features with DevSecOps integration |
Test Strategy Skill
When to Use
Invoke when planning test coverage for a new feature, reviewing test adequacy, or integrating security testing into the CI/CD pipeline.
Test Pyramid (Banking)
/ E2E \ <- Few: critical user journeys (login -> transfer -> verify)
/ Contract \ <- Medium: API contract validation against OpenAPI spec
/ Integration \ <- Medium: real DB (Testcontainers), real HTTP (WireMock)
/ Unit \ <- Many: business logic, validators, calculators
Banking Test Scenario Categories
- Happy path: Normal successful operation
- Boundary values: Zero, negative, max amount, empty string
- Concurrency: Simultaneous operations on same resource
- Idempotency: Duplicate submission handling
- Timeout: External service unavailable
- Authorization: Unauthorized access attempts
- Data validation: Invalid formats, SQL injection attempts
- Currency: Multi-currency, rounding, conversion
Coverage Targets
| Category | Line Coverage | Branch Coverage |
|---|
| Transaction logic | 95% | 95% |
| Authentication | 95% | 90% |
| API controllers | 80% | 80% |
| Utility classes | 80% | 70% |
| Configuration | 60% | N/A |
Security Testing in CI/CD
SAST (Static Application Security Testing)
- Run SonarQube analysis on every pull request
- Fail pipeline on Critical or High severity findings
- Track security hotspots as technical debt
- Include custom rules for banking patterns (BigDecimal usage, PII handling)
DAST (Dynamic Application Security Testing)
- Run OWASP ZAP against staging environment after deployment
- Active scan covers: injection, XSS, authentication bypass, information disclosure
- Baseline scan on every PR merge, full scan weekly
- Fail pipeline on High/Critical findings before production promotion
Security Regression Tests
- Every vulnerability fix must include a regression test
- Regression test proves the vulnerability is exploitable before the fix
- Regression test proves the vulnerability is blocked after the fix
- Security regression suite runs on every build (not just when security code changes)
Chaos Security Testing (Sprint Cycle)
- Run chaos security tests as part of each sprint's test phase
- Include authentication bypass attempts, IDOR tests, rate limit verification
- Automate playbook scenarios from the chaos-security-testing skill
- Report chaos test results in sprint retrospective
Container Security Scanning
- Scan container images before pushing to registry
- Fail pipeline on Critical CVEs in base images
- Verify no secrets baked into image layers
- Validate minimal base image (distroless or Alpine)
- Check for unnecessary packages and elevated privileges