As a QA Manual Tester, my job is to catch bugs — like a ninja in the shadows, but with a checklist 😎. Let me walk you through a real bug I found in a backoffice app. It wasn’t complicated, but it perfectly shows the process I always follow

🔍 The Bug

It started when I noticed something strange while testing the login flow in the backoffice: Admin users couldn’t log in, but users with other roles (like staff or viewer) had no issue at all.

That was an immediate red flag. 🚩 If your admins — the ones managing everything — are locked out, it’s a serious problem.

🧪 The Investigation

Step one: Reproduce the bug — again and again — just to make sure I wasn’t imagining it 😅

I tried logging in:

• With different accounts ✅
• Using different roles ✅
• On both desktop and mobile ✅
• Even in incognito mode, in case it was a cache issue ✅

And yep — same result every time for admin users. They were completely blocked.

So, I popped open the Developer Console and got to work. I focused on two things:

• Any error messages in the Console? ✅
• Any failed requests in the Network tab? ✅

There it was — a failed request to the /api/login endpoint, returning a 403 Forbidden error. Meanwhile, when I logged in using another role, the same endpoint returned 200 OK — and everything worked perfectly.

So, clearly:

• The endpoint isn’t broken.
• But something in the request — probably the user role or permissions — is causing the failure.

🤝 Working With the Developer

After confirming the issue, I didn’t stop at just logging a bug and moving on. I reached out to the dev team to discuss what else this bug could affect — not just at the surface, but deeper, inside the code.

Together, we reviewed:

• The role-checking logic on the backend
• And how other features like password reset or token refresh might rely on the same logic

It was a great collab session. And it helped us realize:

• This might not just be a one-off bug — it could affect other roles too
• Features like login after changing password might break in similar ways
• The login endpoint might become unstable if other roles or scenarios hit the same auth logic

📝 Writing the Bug Report

Once I gathered all the evidence — screenshots, console logs, failed endpoints — I wrote a clear, detailed report in our task tracking system.

Here’s the format I used: