A date is not a version: strict parsing under OSV ranges
A vulnerability range is a claim about ordering, and it is worth no more than the version parser sitting underneath it. Walk an OSV range's events i…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
One NCR form to rule them all stopped working the day we added our 30th supplier
Last month, a buyer pinged me: "Why is this incoming-inspection NCR asking me whether the customer filed a complaint?" Fair question. It's because w…
Node.js Email Service: Auditing Deliverability, Template Testing, Preview, and Domain Auth
A compliance notice changes the email-service decision because a pleasant template editor and a provider-level "delivered" status are not an audit r…
The guardrail receipt
Short answer A guardrail receipt is a tamper-evident audit record proving that an AI guardrail evaluation occurred with a defined policy, input scop…
PII: CPF and CNPJ masking
Short answer CPF and CNPJ must be masked in non-production AI systems and logs under LGPD’s principle of data minimisation (Art. 6, III) and confide…
The people an accessibility overlay is for rate it worse than everybody else
The pitch is close to irresistible. One line of JavaScript, no engineering work, no audit, and a legal problem becomes a subscription line item. If…
Auth Provider Event History vs. Your Audit Log: SOC 2 Evidence
A customer-support system cannot treat an identity provider's event history as the complete record of a risky login. The provider can record authent…
Compliance Evidence Under Load: 500 Local or Hosted PDF API Jobs at Scale
Short answer: use a hosted PDF API when a small team needs repeatable form filling across bursty workers and can accept a measured network hop; keep…
The EU Cyber Resilience Act Reporting Duty Started on 11 September 2026: What Manufacturers Now Have to Do in 24 Hours
The EU Cyber Resilience Act Reporting Duty Started on 11 September 2026: What Manufacturers Now Have to Do in 24 Hours On 11 September 2026, Article…
The AI approval boundary nobody talks about until the audit finds it
The first time I saw an AI approve a CAPA closure, I'll admit I paused. Not because the decision was wrong — it wasn't — but because I couldn't find…
Не конкурируй с ИИ — управляй им. Как специалисту по ИБ остаться востребованным в эпоху ИИ-агентов
Привет, Хабр! Меня зовут Алексей Лукацкий, я бизнес-консультант по безопасности и Chief Evangelist Officer в Positive Technologies, а до этого больш…
Begin with control; the real win is turning it into daily practice
To be fair, "we have a QMS" is the easiest checkbox in a notified‑body audit. The hard part is that regulators, auditors and — most importantly — fr…
Help wanted: validate a React retention and records review SPFx sample
Help wanted: validate a React retention and records review SPFx sample A new read-only React sample is ready for the PnP SharePoint Framework webpar…
The cleanest way to keep your compliance‑AI out of the EU AI Act high‑risk class: AI proposes, a human approves and signs
I nearly signed off on an "auto‑close" feature for an AI that triaged evidence requests. It would have saved the team hours a week. We didn't enable…
Picking an eQMS for a 200-person Class II device shop — a pragmatic comparison
I work in a 200-person Class II medical device company with two QA/RA folks, three embedded-hardware teams, a small supplier-quality group, and engi…
Seller Notification Evidence — Transactional Email API and Domain Verification
Short answer: choose a transactional email API by the evidence it can preserve for each marketplace order notice, then validate domain authenticatio…
Где заканчиваются отчёты и начинается безопасность: аудит ИБ без «бумажной пыли»
Всем привет! Меня зовут Алёна, я руководитель группы аналитики отдела Compliance и безопасности данных в Ozon. Звучит длинно, поэтому мы с командой…
AI Governance 101: What ML Practitioners Actually Need to Know
AI regulation isn't abstract policy anymore. If you're building systems that touch hiring, credit, healthcare, or law enforcement, there are now leg…
Compliance-grade pentesting is a scan wearing a suit
You paid for a PDF document that was passed off as a penetration test. You spent money on a penetration test. All you received was an export from a…
EU AI Act High-Risk Deadline: August 2, 2026 — What U.S. AI Companies Must Do Now
The EU AI Act's high-risk deadline is August 2, 2026 — 9 days from this article's publication. If your AI system serves EU users and falls under Ann…
Aligning NHI Governance With Financial Services Regulatory Expectations
Aligning NHI Governance With Financial Services Regulatory Expectations Explore how NHI governance, secrets management, and risk framing support reg…
Signed execution receipts: a primer on why logs are not evidence
Every team running AI agents keeps logs. Almost none of them can answer the question that actually gets asked in a dispute: why should anyone believ…
From Policy to Pipeline: Making Compliance an Engineering Property
Part 4 of "Trust the Machine" —> a series on building AI infrastructure that is secure, compliant, and governable by design. The thread that ties…
Traceability matrices die when treated as documents — how to keep traceability living
I used to maintain a traceability matrix as a 30‑row table in a Word document. It looked tidy on a submission day and then rotted quietly for the ne…
DPDP compliance costs for Indian startups: what to budget before 13 May 2027
DPDP compliance costs for Indian startups: what to budget before 13 May 2027 Summary. Full compliance with India's Digital Personal Data Protection…
France's e-invoicing mandate lands 1 September 2026. The developer's playbook.
The deadline nobody can opt out of On 1 September 2026, every business established in France that is subject to VAT — whether or not it actually cha…
Where usability files actually break — and what I do about it
I stopped treating the usability file as a compliance artifact years ago — it’s where product design and real people collide. When it’s done badly,…
Mexico’s PSM registry after CTA: what filings still matter
Mexico’s Public Registry of Commerce still runs through state-level implementation. Look up the same company twice and historical coverage can shift…
We built a SOC 2 reviewer for AI sessions, and kept AI out of the execution path
We built a SOC 2 reviewer for AI sessions — and kept AI out of the execution path AI coding tools now touch auth code, modify Terraform, handle cred…
How to Build a Compliant Fintech App in the UAE
The UAE fintech sector spans three distinct regulatory authorities. Whether you are building for the CBUAE-licensed mainland, the DIFC, or the ADGM,…