Shift-Left Testing
What Is Shift-Left?
Shift-left means moving testing activities earlier in the development lifecycle. Instead of finding bugs after code is written, prevent them before code is written. The earlier a defect is found, the cheaper it is to fix.
Traditional: Requirements → Design → Code → Test → Deploy
↑
Testing starts here
Shift-Left: Requirements → Design → Code → Deploy
↑ ↑ ↑
| | |
Review Review Unit tests
criteria testability during dev
with QA with QA
The Cost of Late Bug Detection
The cost of fixing a bug increases exponentially the later it is found:
| Stage Found | Relative Cost | Why |
|---|---|---|
| Requirements | 1x | Change a document |
| Design | 5x | Redesign before building |
| Development | 10x | Rewrite code |
| Testing | 20x | Find, report, fix, retest |
| Production | 100x | Incident response, customer impact, reputation damage |
A missing validation rule caught during requirements review costs 15 minutes to fix. The same missing validation discovered in production through a security breach costs thousands of dollars and months of remediation.
Practical Shift-Left Activities
Requirements Review
QA reviews user stories before sprint planning, flagging ambiguities and missing edge cases.
What to look for:
- Vague acceptance criteria ("the system should be fast")
- Missing error handling ("what happens when the API is down?")
- Undefined boundary conditions ("what is the maximum file size?")
- Missing non-functional requirements (performance, accessibility, security)
- Conflicting requirements with existing features
Before QA review:
"As a user, I want to upload a profile photo."
After QA review (questions raised):
- What file formats are accepted?
- What is the maximum file size?
- What happens if the upload fails?
- Is there a minimum resolution?
- Should the photo be cropped to a square?
- What about the existing photo -- is it kept on failure?
After refinement:
"As a user, I want to upload a profile photo (JPEG, PNG, or WebP, max 5MB, min 100x100px). The system should crop to a square, show a preview before saving, and display a clear error message if the file is too large, wrong format, or too small. Existing photo should be kept if upload fails."
The refined story has testable criteria. The original did not.
Three Amigos Sessions
Developer + QA + Product Owner meet before work begins to align on acceptance criteria. (See dedicated Three Amigos section.)
Test-Driven Development (TDD)
Developers write tests before implementation. The test defines the expected behavior, and the code is written to make the test pass.
1. Write a failing test (Red)
2. Write the minimum code to pass (Green)
3. Refactor the code while keeping tests green (Refactor)
QA's role in TDD: QA does not write unit tests (developers do), but QA can:
- Review TDD tests to verify they cover the right scenarios
- Suggest edge cases that the developer's tests should cover
- Verify that TDD tests align with acceptance criteria
Static Analysis
Linters, type checkers, and security scanners catch issues before tests run. These tools provide immediate feedback in the developer's IDE and in CI pipelines.
| Tool | What It Catches | When It Runs |
|---|---|---|
| ESLint / Pylint | Code quality issues, potential bugs | IDE + CI |
| TypeScript / mypy | Type errors | IDE + CI |
| Snyk / Semgrep | Security vulnerabilities | CI |
| Prettier / Black | Formatting inconsistencies | IDE + CI (pre-commit hook) |
| axe-core | Accessibility violations | CI + browser tests |
Pair Testing
QA pairs with a developer during implementation to catch issues in real time.
How pair testing works:
- Developer implements a feature while QA observes
- QA asks questions: "What happens if I click here while loading?" "What if this field is empty?"
- Developer addresses issues immediately (before committing)
- Both agree on what automated tests should cover
When pair testing is most valuable:
- Complex features with many edge cases
- Features with significant security or financial implications
- New team members learning the codebase
- Rebuilding trust after a series of production incidents
Shift-Left in Practice: A Sprint Timeline
Day 1 (Sprint Planning):
QA reviews stories, asks clarifying questions, identifies dependencies
Day 2-3:
Three amigos sessions for the highest-priority stories
QA writes draft test cases from acceptance criteria
QA prepares test data and environment
Day 4-7:
Developers implement features
QA reviews PRs as code is written (not after)
QA runs automated tests on feature branches
Pair testing on complex features
Day 8-9:
Exploratory testing on completed features
Full regression run
Day 10 (Sprint End):
Sprint review with quality metrics
Retrospective with shift-left insights
Notice that QA is active from Day 1, not waiting until Day 7 when "code is ready for testing."
Measuring Shift-Left Effectiveness
Track these metrics to verify that shift-left is working:
| Metric | Before Shift-Left | After Shift-Left |
|---|---|---|
| Defects found in testing | 80% of total | 40% of total |
| Defects found in requirements/design | 5% of total | 35% of total |
| Defects found in production | 15% of total | 5% of total |
| Average defect fix time | 4 hours | 1 hour |
| Stories reopened after "Done" | 20% | 5% |
Common Resistance and How to Address It
| Resistance | Response |
|---|---|
| "QA slows down planning" | "10 minutes of clarification saves 4 hours of rework" |
| "Developers don't need QA in their PRs" | "QA catches testability issues early; fewer bugs in testing phase" |
| "We don't have time for three amigos" | "15 minutes per story prevents days of rework on undefined behavior" |
| "Static analysis is too noisy" | "Configure it to match your standards; disable rules that don't add value" |
| "We'll test it later" | "Later means more expensive. The same bug in production costs 100x more." |
Hands-On Exercise
- Pick 3 stories from your next sprint and review them for testability before planning
- Attend (or organize) a three amigos session for the highest-risk story
- Write test cases from acceptance criteria before the developer starts coding
- Pair with a developer for 1 hour during implementation and note how many issues you catch in real time
- Measure the percentage of defects found at each stage (requirements, development, testing, production) for the last 3 sprints