Description
charge. Which one is lying?
Payment defects are quiet. Nothing crashes, the page says thank you, and the discrepancy surfaces days later in reconciliation — found by somebody in finance who cannot explain it. This kit is 114 test cases for the parts of a checkout where that happens.
**Every defect is verified.** All 18 were confirmed by running them — each fires when armed
and passes when disarmed. That check is the expensive part, and it is the part a generated
case list does not have.
What is inside
The playbook, 52 pages. Why payments fail differently, the four records that must agree, and the eight failure families — declines, 3D Secure, duplicates and races, webhooks, refunds, tax and rounding, cart and pricing security, and reconciliation.
The case bank, 114 cases. A filterable spreadsheet with preconditions, steps, expected result and severity for every case. Plus a test card reference, a decline message map, a bug report template and a client sign-off sheet.
The practice sandbox. A working checkout with 18 deliberate defects, each switchable on and off individually. Run a case, watch it fail, disarm the defect, run it again.
The free 45-minute smoke test. The release gate — the smallest set of checks whose passing gives you enough confidence to ship.
Who it is for. Anyone shipping a checkout: e-commerce, SaaS billing, marketplaces, or a local rail like bKash, Nagad or SSLCommerz.
How this differs from Juice Shop and DVWA
Those are excellent, free, and built for a different job — they teach you to attack an application. This teaches you to test one.
Juice Shop will not show you a subscription that keeps billing after cancellation, a proration that ignores an active discount, or an AI feature that refuses a legitimate question. And it has no switch: you cannot disarm a defect and confirm the same check now passes, which is where most of the learning is.