The summary.
REPORT PERCENTILES, NOT AVERAGES
Averages conceal the slow requests users actually notice, and the ninety-ninth percentile at volume is many people.
REPEATED IDENTICAL REQUESTS HIT CACHES AND MEASURE NOTHING REAL
Vary data per virtual user, model think time and operation mix, and ramp gradually to see the curve rather than only the breaking point.
Verify the test tool is not itself the bottleneck.
SOAK TESTING FINDS WHAT SHORT TESTS CANNOT
Leaks and gradual degradation appear only after hours or days.
DEPENDENCY SCANNING IS THE HIGHEST-VALUE AUTOMATED SECURITY CHECK
Most applications carry far more third-party code than their own, and the vulnerabilities are published.
HIDING A CONTROL IN THE INTERFACE IS NOT AUTHORISATION
Call the endpoint directly, as every role, against every protected function — and automate that matrix.
Password reset is a route to account takeover and is frequently weaker than the login.
SLOW DEPENDENCIES ARE WORSE THAN FAILED ONES
They consume resources while producing nothing. Timeouts, concurrency limits and circuit breakers are what stop a cascade.
