Quality Assurance & Testing

Overview

Testing at Stripe Systems is not a phase that happens after development — it is embedded into every sprint. We follow a test-driven development approach where test cases are written before implementation, ensuring that every feature has defined acceptance criteria and automated verification from the start.

Our testing strategy operates across multiple layers. Unit tests validate individual functions and class methods in isolation using Jest, Vitest, or flutter_test. Integration tests verify that modules interact correctly — API endpoints return expected responses, database queries return accurate data, and third-party service integrations handle both success and failure paths. End-to-end tests using Playwright or Cypress simulate real user workflows across the full application stack.

For mobile applications, we run automated UI tests on real device farms (Firebase Test Lab, AWS Device Farm) across multiple OS versions and screen sizes. Flutter widget tests validate component rendering and interaction behavior without the overhead of full device emulation.

Performance testing uses JMeter and k6 to establish baseline response times, identify throughput limits, and detect memory leaks under sustained load. We define performance budgets — maximum acceptable response times for critical API endpoints and page load metrics — and alert when regressions are detected.

Security testing includes OWASP Top 10 vulnerability scanning, dependency auditing for known CVEs (npm audit, Snyk), input validation testing for injection attacks, and authentication flow verification. For applications handling sensitive data, we conduct penetration testing following OWASP Testing Guide methodology.

API testing uses Postman collections with automated assertion scripts, run as part of CI pipelines via Newman. Contract testing between microservices uses Pact to prevent integration failures when services evolve independently.