nth Labs
Get early access
Security Blog Help About
Get early access
Use it for

Test your checkout

A checkout is where a dead button costs the most and where a tester must never cause a charge. The rules are fixed in code: no card number is ever typed, no payment step is taken on a live product, and every refusal is on the map with its reason.

What a run does

  • The Explorer reaches the checkout and maps its forms and controls. Payment and identity fields are never filled; a payment step on a live product is never pressed; both are recorded as refusals, by name.
  • On a staging copy with writes allowed, the forms are submitted with obvious test data, and a submit that returns a server error is filed as a critical defect with the status it answered.
  • The panel says where people stop. A checkout screen high on the quit strip is a leak the Lab prices as what fixing it is worth.
  • A confirmed finding becomes a standing re-check, so a checkout that breaks again is filed at critical the day it happens.

What is never done

Nothing destructive is pressed. No card number, no bank detail, no identity number is ever typed. On a live product, nothing is written without the switch in Settings turned on. These are refusals in code, each with a guard, and the security page lists them.

How to start

Point it at a staging copy of the product with a test account saved and writes allowed, and the whole flow is exercised. Point it at production and the flow is mapped without a single submission.