Description

Bought separately these are $176. Together they are $98.

Four playbooks, four practice sandboxes, and the release gate for each — covering the parts of a product where a defect costs money rather than embarrassment.

Every defect is verified. All 72 were confirmed by running them: each fires when armed and passes when disarmed. That check is the expensive part, and it is the part a generated case list does not have.

What is inside

• Four practice sandboxes. A checkout, an authentication service, an AI support assistant and a billing engine — each with 18 deliberate defects, switchable individually. Run a case, watch it fail, disarm the defect, run it again. Python, no installation beyond the interpreter.
• Four playbooks, 133 pages. The reasoning behind the cases: why each domain fails differently, which checks matter most, and how to report a finding so it gets fixed rather than filed.
• Four case banks, 401 cases. Filterable spreadsheets with preconditions, steps, expected result and severity. Plus test card references, a dunning matrix, an eval set template, a red team prompt library, error message maps and a client sign-off sheet in every volume.
• Four free smoke tests. The 18 checks worth running before every release, one set per domain.

Why all four rather than the one you need today

The domains leak into each other. The reconciliation habit you learn in payments is what catches a billing defect three months later. The session-handling checks in authentication are the ones that matter when a subscription is cancelled and access does not stop. The evaluation discipline in the AI volume is the same discipline the payment sign-off sheet needs.

One volume teaches a domain. Four teach a method.

How this differs from Juice Shop and DVWA

Those are excellent, free, and built for a different job — they teach you to attack an application. These teach you to test one, and they cover ground no security lab does: proration, dunning, reconciliation, AI evaluation. And they have a switch, so you can disarm a defect and confirm the same check now passes.

Python for the sandboxes, no other installation. One download, no subscription. Licensed for one practitioner including paid client work.