Skip to content
Rearway logorearwayLet's talk ↗

Services · QA & production readiness

QA & Production Readiness

Book a call for a quote ↗

01

The problem

An MVP is built to prove an idea, and getting there fast usually means some things are left out:

  • Untested journeys: the happy path works, but edge cases, error states and unusual devices haven't been tried.
  • Unknown traffic limits: nobody knows what happens at ten times today's traffic.
  • Fragile infrastructure: background jobs, queues and databases have never been tested under pressure.
  • Unchecked security: authentication, access control and secrets haven't been reviewed.
  • No safety net: there is little automated testing, so every release is a risk.

Launching like this tends to mean outages, data issues and slower releases just when customers start arriving.

02

What we do

Functional testing, end to end

  • Test plan: a plan built from your user journeys and business rules.
  • End-to-end testing across web, mobile and APIs:
    • sign-up, login and password reset
    • payments and refunds
    • notifications
    • roles and permissions
    • edge cases and error handling
  • Compatibility testing: cross-browser and cross-device checks, including small screens, older OS versions and slow networks.
  • Accessibility: checks against WCAG 2.2 AA.
  • Regression suite: an automated suite (Playwright, plus Flutter integration tests or Appium for mobile) that runs in your CI pipeline.

Load testing

We model realistic traffic from your analytics or launch plans, then measure response times, error rates and resource use at expected peak traffic.

Stress and spike testing

We push past expected traffic to find the breaking point, see how the system fails, and check that it recovers cleanly once the load drops.

Scalability and soak testing

  • Autoscaling: we check that autoscaling, connection pools, queues and caches grow with load.
  • Soak testing: long tests run for hours to expose memory leaks, connection exhaustion and slow degradation.

Security testing

A focused security pass before launch:

  • Application and API checks: OWASP Top 10 and OWASP API Security Top 10, covering authentication, access control between users, input validation and rate limits.
  • Secrets: scanning code and mobile bundles for exposed keys.
  • Cloud configuration: a baseline review.

For a full assessment, see Security Testing & Threat Analysis.

Production readiness review

  • Observability: logging, metrics, tracing and alerting.
  • Recovery: backups, with a restore test, and a disaster recovery plan.
  • Release process: the CI/CD pipeline and rollback procedure.
  • Configuration: environment and secrets management.
  • Operations: incident runbooks and on-call basics.

Fixing what we find

Our engineers can fix the issues themselves or pair with your team, then retest.

03

How it works

  1. Scoping call. We cover your product, users, launch date and risks.
  2. Test strategy. We agree journeys, traffic targets (for example, peak concurrent users and requests per second), and pass/fail criteria.
  3. Functional testing and automation. We build and run the test suites.
  4. Load, stress, scalability and soak tests. These run in a production-like environment.
  5. Security pass.
  6. Readiness report. A go/no-go recommendation with a prioritised fix list.
  7. Fix and retest. We confirm fixes before launch.

04

What you receive

  • Test strategy and test cases linked to your user journeys.
  • An automated regression suite running in your CI pipeline.
  • Defect register giving each issue's ID, severity, steps to reproduce, owner and status.
  • Performance test report:
    • scenarios run
    • throughput, latency (p50/p95/p99) and error rates
    • the breaking point and what fails first
    • recommended capacity and autoscaling settings
  • Security findings. Each one is rated with CVSS and comes with a recommended fix.
  • Production readiness checklist and go/no-go summary.
  • Retest results.

05

Standards and tools

Aligned with: ISTQB test practices, WCAG 2.2, OWASP Top 10, the OWASP API Security Top 10, and the reliability guidance in the AWS Well-Architected Framework and Google Cloud Architecture Framework.

Tools:

  • Test automation: Playwright, Cypress, Flutter integration_test, Appium
  • API testing: Postman/Newman
  • Load and performance testing: k6, JMeter, Locust
  • Security testing: OWASP ZAP, Burp Suite, gitleaks
  • Observability: Grafana, Cloud Monitoring, CloudWatch

06

Packages

We offer fixed-price packages for businesses with different needs. Scope, timeline and deliverables are agreed in writing after the scoping call.

07

Next step

Book a 30-minute call to talk through your product and what you need.

Book a call

FAQ

Questions

When should we do this?

Ideally four to eight weeks before a public launch, a big marketing push, or a funding milestone that will bring traffic. That leaves time to fix what we find.

Do you test in production?

We test in a staging environment that matches production as closely as we can. In production, we limit ourselves to agreed read-only checks and monitoring.

Can you work with our existing QA team?

Yes. We can add load, scalability and security testing to their functional work, or set up the automation they will maintain.

What if the system fails the load test?

That's the point of testing before launch. We show where it fails, such as the database, a service or a queue, and recommend fixes. Our engineers can make them, and then we retest.

Do you only test, or do you also fix?

Both. You can choose a test-and-report package, or one that includes fixing the issues.

Which platforms do you cover?

Web apps, iOS and Android (including Flutter and React Native), REST and GraphQL APIs, and backends on AWS or Google Cloud.

Start a project

Have a product to ship?

Engagements are fixed-price packages, shaped to the business. Book a call for a quote.

Book a 30-min call ↗