Principles
- Describe the evidence before the conclusion
- Separate symptoms, causes and recommendations
- Fix user-facing risk first
How to do it
Define the scope
List the pages, paths and environments covered, and what's excluded.
Gather evidence
Save file locations, behavior, logs or screenshots.
Confirm the cause
Rule out other explanations with the smallest possible experiment.
Prioritize
Rank by impact, likelihood and cost to fix.
Before you call it done
- Findings are reproducible
- Evidence can be located
- Priorities have reasons
- No recommendation is presented as fact