Baike.dev
Log in
Back to tool/Back to issues
#55·claude-skills

Performance & Security Testing: Systematic integration into workflow

Author: JeffallanCreated Dec 17, 2025Updated Mar 23, 2026

Summary

Integrate performance and security testing systematically into the epic workflow, with clear triggers, requirements, and metrics tracking.

Problem

Current state (from QA analysis):

  • Performance Testing: 2.0/10 - Only appears in retrospective analysis
  • Security Testing: 3.0/10 - Ad-hoc, not systematic

Issues:

  • No performance baselines established
  • No performance SLAs defined
  • Security considerations mentioned but not enforced
  • No security test checklist
  • No vulnerability scanning integration
  • Both are afterthoughts rather than built into the process

Proposed Solution

Performance Testing Integration

1. Add to /create-epic-plan (Testing Strategy section):

markdown
### Performance Testing
- **Baseline Metrics:** Establish before changes
  - API p95 response time: [current]
  - Page load time: [current]
  - Database query time: [current]

- **Performance Tests Required When:**
  - [ ] Database queries added/modified
  - [ ] API endpoints added/modified
  - [ ] Large data processing
  - [ ] Third-party integrations
  - [ ] User-facing latency-sensitive features

- **Performance SLAs:**
  - API p95 response time: < 200ms
  - Page load time: < 2s
  - Database query time: < 100ms

- **Load Testing:** Required for high-traffic features

2. Add to /generate-implementation-plan:

markdown
#### Performance Tests to Write
- [ ] Benchmark: [specific operation] < [target]ms
- [ ] Load test: [endpoint] handles [N] concurrent users
- [ ] Query performance: [query] executes < 100ms

3. Add to /complete-sprint:

markdown
### Performance Metrics
- **API Response Times:**
  - p50: [ms] | p95: [ms] | p99: [ms]
- **Slow Queries (> 100ms):** [count]
- **Performance Regressions:** [count]
- **Load Test Results:** [summary]

Security Testing Integration

1. Add to /create-epic-plan:

markdown
### Security Testing
- **Security Review Required:** [Yes/No]
  - Triggers: Auth changes, PII handling, API changes, permissions

- **Security Tests Required When:**
  - [ ] Authentication or authorization changes
  - [ ] User input validation added
  - [ ] File uploads implemented
  - [ ] API endpoints (public or authenticated)
  - [ ] Data encryption/decryption
  - [ ] Third-party integrations

- **Security Test Checklist:**
  - [ ] Input validation (SQL injection, XSS, command injection)
  - [ ] Authentication bypass attempts
  - [ ] Authorization escalation (IDOR, privilege escalation)
  - [ ] CSRF protection
  - [ ] Rate limiting
  - [ ] Sensitive data exposure

2. Add to /execute-ticket (for security-flagged tickets):

markdown
### Security Checkpoint
- [ ] OWASP Top 10 checklist reviewed
- [ ] Input validation implemented
- [ ] Authentication/authorization tested
- [ ] Security-auditor agent review (if high-risk)

3. Add to /complete-sprint:

markdown
### Security Metrics
- **Vulnerabilities Found:** [count by severity]
  - Critical: [count] | High: [count] | Medium: [count]
- **Vulnerabilities Remediated:** [count]
- **Security Reviews Conducted:** [count]
- **Time to Patch (critical):** [average days]

Acceptance Criteria

  • Performance testing criteria added to epic planning
  • Performance test requirements in implementation plans
  • Performance metrics tracked in retrospective
  • Security testing triggers defined in epic planning
  • Security checkpoint added to execution workflow
  • Security metrics tracked in retrospective
  • Clear documentation of when each type applies

Related

  • Supports overall QA maturity improvement
  • Integrates with CI/CD pipeline
  • May require additional tooling (load testing, security scanning)

Source: Jeffallan/claude-skills

View original on GitHubView discussion on GitHub