| 1 | User Types | admin, guest, banned, new user, power user, bot/scraper |
| 2 | Input Extremes | empty, null, max length, unicode, special chars, SQL/script injection |
| 3 | Timing | concurrent access, race conditions, timeout, slow network, retry storms |
| 4 | Scale | 0 items, 1 item, 1M items, pagination boundary, cursor wrap |
| 5 | State Transitions | first use, mid-flow abort, resume after crash, partial completion |
| 6 | Environment | mobile/low-end CPU, no JS, screen reader, proxy/VPN, different timezone/locale |
| 7 | Error Cascades | DB down, API timeout, disk full, OOM, network partition, partial write |
| 8 | Authorization | expired token, wrong role, shared/public link, CORS, CSRF, privilege escalation |
| 9 | Data Integrity | duplicate entries, orphan references, encoding mismatch, concurrent schema migration |
| 10 | Integration | webhook replay, API version mismatch, third-party outage, contract drift |
| 11 | Compliance | GDPR deletion request, audit logging gap, data retention, accidental PII exposure |
| 12 | Business Logic | edge pricing (zero/negative), coupon stacking, refund after partial delivery, free tier limits |