opaland

Run axe-core through Playwright on every key screen, fail on critical and serious only, then run the seven manual checks a DOM scanner structurally cannot perform - because automated tooling detects roughly a third of WCAG success criteria and the other two thirds are what actually stops a disabled user.

Run the six passive security checks a QA engineer can own - auth boundaries, IDOR, error handling, user enumeration, headers, ZAP baseline - each as a protocol with its fixture requirement and its well-known way of being run wrong, so a check that tests nothing stops looking like a pass.

Find what a user story does not say before writing a single test - undefined terms, unstated clocks, cross-rule contradictions, missing error paths - and turn each into a numbered question for the product owner instead of a silent guess baked into an assertion.