Testing Heuristics and Mnemonics
What is a heuristic?
A heuristic is a mental shortcut or a rule of thumb. It's a quick way to think through a problem or a gateway to get to deeper thinking.
What is a mnemonic?
A mnemonic is a memory-enhancing tool or technique that helps individuals retain and recall information by connecting new data to familiar patterns, images, or structures. A mnemonic is a very simple heuristic. The most common mnemonics you may remember from childhood are My Very Educated Mother Just Served Us Nachos as a way to remember the order of the planets from the sun. A mnemonic could also be a jingle or a chunk of information used to remember a phone number.
How can mnemonics be used to test?
Mnemonics can be thought of as shortcuts to get to deeper testing. They are easy to remember and nudge you towards areas of the API you may know less about. Testing is about gathering information about the state of something, and these heuristics will hopefully lead you to better information than randomly clicking or following a strict set of rules.
Don't think that testing should be limited to these mnemonics — it's the complete opposite. As someone with agency, you are encouraged to come up with your own mnemonics and testing strategy that works for you and helps improve your mental model.
A word of warning. Heuristics are great, but they are a double edged sword. The more you approach a problem in the same way, the more you are at risk of missing areas of the system that could also have bugs. Testers should always be looking at new ways to test and improve their skills, but remember that a heuristic is also a bias. These are very by definition NOT "best practices".
That being said, let's dive into the mnemonics.
CRUD
Create, Read, Update, Delete
This mnemonic is very helpful when testing something like an API or a web app. It doesn't encourage much deep thinking, but it gives us a direction of where to look. From there we can ask deeper questions such as:
- What happens if I try to access the same resource twice?
- What happens if I try and delete a resource?
- Should I be allowed to update X resource?
And so on.
BINMEN
Boundary, Invalid, Null, Method, Empty, Negative
BINMEN is more specific for APIs and can be applied to payloads, parameters, headers and URIs. Even just starting at the first letter, there are lots of questions that should be in the front of your mind. What boundaries are there? Are they explicitly documented anywhere or just assumptions? What happens if I breach the perimeter of the boundary? BINMEN can also be used through a UI as well, as it should get you into interesting areas of the software.
VADER
Verbs, Auth, Data, Error, Response
VADER is also an API-specific mnemonic (that can be applied elsewhere) that covers a bit more ground than CRUD. When it comes to verbs we can look at the most common, but we can also check lesser known verbs such as HEAD (shows only the headers) and OPTIONS (shows the available verbs).
Further reading: VADER: A REST API Test Heuristic
POISED
Parameters, Output, Interop, Security, Errors, Data
POISED is one of my favourite mnemonics, because it is more aimed at looking for trouble, rather than just gathering information. Although some of the letters can be generic (such as security — a huge topic) it can lead you to look more into APIsec OWASP or how you can test your current API's authentication.