Description
looks correct — internally consistent, properly formatted, and wrong by a fixed percentage. It is charged to every affected customer, every month, until somebody notices. Nobody notices.
Billing defects accrue. Most defects cost you once; these cost you on a schedule, which is why severity in this domain is a rate rather than an event.
**Every defect is verified.** All 18 were confirmed by running them — each fires when armed
and passes when disarmed. That check is the expensive part, and it is the part a generated
case list does not have.
What is inside
The playbook, 26 pages. Trials, renewals and the month-end anchor problem, proration worked by hand, the dunning state machine, cancellation, refunds and credits, coupons, tax and invoicing, entitlements, and revenue reconciliation.
The case bank, 99 cases. Plus a proration reference, a dunning matrix, time-travel recipes, a bug report template and a client sign-off sheet.
The practice sandbox — with a clock you control. 18 switchable defects and a time-travel endpoint. Advance thirty days and watch a renewal charge twice. Advance ninety and watch a cancelled subscription keep billing.
The free 45-minute smoke test. Every check needs the clock moved, which is exactly why most billing systems ship untested.
Who it is for. Anyone running subscriptions — SaaS, membership, or anything that charges on a schedule.
How this differs from Juice Shop and DVWA
Those are excellent, free, and built for a different job — they teach you to attack an application. This teaches you to test one.
Juice Shop will not show you a subscription that keeps billing after cancellation, a proration that ignores an active discount, or an AI feature that refuses a legitimate question. And it has no switch: you cannot disarm a defect and confirm the same check now passes, which is where most of the learning is.
