jaktestowac/non-functional-testing
Accessibility, performance and load, and application security testing.
Runs a structured accessibility audit of a page, a sampled set of templates, or a user journey, with findings mapped to WCAG 2.2 criteria, manual retest guidance, and technical or stakeholder-ready output. Use when a release, compliance review, or redesign needs more than a scanner pass, or when keyboard, focus, and dynamic-state behaviour across a flow must be checked. For a quick check of one URL, use the a11y-webpage-audit command.
Audits one webpage for accessibility, maps each issue to WCAG 2.1/2.2 AA, and gives reproduction steps, fixes, and retest steps. Use when a single page, component, or pull-request preview needs a quick accessibility check before merge or release. For multi-page journeys, template sampling, or stakeholder-ready reporting, use the a11y-audit-deep-dive command.
Performs webpage and user-flow accessibility audits against WCAG 2.2: an automated axe-core pass, manual keyboard, screen-reader and visual checks, findings mapped to exact success criteria, prioritized remediation, and stakeholder-ready summaries. Use when auditing accessibility on a URL or flow, triaging suspected a11y issues, or producing technical findings with practical next steps. For a sign-off record of a pass already done, use attesting-manual-verification.
Designs a risk-based performance and reliability test strategy for a system's critical flows (objectives, workload types, and concrete smoke, load, stress, soak, and spike scenarios) and drafts scripts in the project's existing tool, defaulting to k6. Use when a system has no performance testing yet, before a launch or traffic event, or when SLOs exist but nothing checks them. Writes plans and scripts; runs nothing beyond a confirmed smoke check.
Applies OWASP-informed security testing within a tester scope: an authorization gate before any probing, role and permission matrices, broken access control and IDOR checks (one user seeing the data of another by changing an ID in the URL), input validation and injection observation, session and auth behaviour, and safe reporting of findings. Use when testing auth-protected features, when a security review needs QA coverage, when an exploratory session surfaced something security-shaped, or when access control needs a systematic check rather than a spot check.
Designs and runs performance and load tests: workload modelling from real traffic, thresholds tied to SLOs, warmup and ramp shapes, percentile-based analysis, and lightweight CI perf checks with k6 or Artillery. Use when a feature has latency or throughput requirements, when "it feels slow" needs to become a number, when a launch needs to know how many concurrent users the system can handle, or when a performance result needs interpreting rather than just collecting.