Minimum smoke tests for small teams: 10 tests to stay alive

A four-person team doesn't need 400 test cases. It needs ten tests where failure means a very long night.

This is the minimum smoke set I recommend for small SaaS / web products. Copy, rename flows for your app, run after every deploy.

How to pick your ten

• Business before tech: failure = lost money, users, or trust.
• ~5 minutes total (parallelize if you can).
• Fixed seeds — no random prod data.
• One clear failure reason per test.

Playwright, Cypress, or a signed manual checklist all work — what matters is running it every ship.

---

Ten tests to stay alive

1. Successful login

• Business goal: Users can enter the app.
• Seed: buyer@test.local / fixed password.
• Expected: Dashboard redirect, user name visible.

2. Wrong password

• Business goal: No leak, no crash.
• Seed: valid user, bad password.
• Expected: Generic error, 401/403, no session.

3. Core payment / conversion flow

• Business goal: Revenue.
• Seed: test product/plan, Stripe test card.
• Expected: Paid/Success state, confirmation shown.

4. Create core resource (order, ticket, project…)

• Business goal: Main value prop works.
• Seed: user with create permission.
• Expected: Item in list, valid ID.

5. Read / view that resource

• Business goal: CRUD isn't create-only theater.
• Seed: output from test #4 or preset seed.
• Expected: Detail page matches data, no 404.

6. Basic authorization (user vs admin)

• Business goal: No accidental admin exposure.
• Seed: user@test without admin role.
• Expected: Admin routes 403/redirect, no dangerous buttons.

7. API health / main public page

• Business goal: Site is up.
• Seed: none.
• Expected: / or /health returns 200, correct title.

8. Important form — valid submit

• Business goal: Leads, support, feedback aren't lost.
• Seed: minimal valid fields.
• Expected: Success feedback + record (or test email).

9. Form — validation errors

• Business goal: Bad input doesn't silently 500.
• Seed: invalid email / empty required fields.
• Expected: Inline errors, no server explosion.

10. Logout + session end

• Business goal: No zombie sessions.
• Seed: logged-in user.
• Expected: After logout, back button can't reach protected pages.

---

Per-test template

## Test NN: [Name]
- Business goal:
- Seed / account:
- Steps (≤ 5):
- Expected:
- Owner:
- Tool: manual | Playwright | ...

When to run

As you grow, add regressions from incident → test. Don't cram everything into smoke.

---

List your product's ten "touch and die" flows. If you can't find ten, start with whatever is closest to money.