What does a QA test report include?

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

A QA report lists every bug found with a title, the steps to reproduce it, what happened versus what should have happened, the device and browser, a severity, and often a screenshot or recording. Good reports also list what was tested and passed, so you know the coverage, and suggest a fix where the cause is clear.

Fields in a good report

Steps to reproduce: Exact clicks and inputs, so anyone can see the bug.
Expected and actual: What should happen and what does.
Environment: Device, browser, account and role.
Severity: Blocks launch, major, minor, cosmetic.
Evidence: Screenshot or screen recording.
Coverage: Flows tested and passed.

Using it

Paste each bug into your AI tool with the steps and expected result, fix, and ask the tester to confirm. See QA testing.

An example finding

Title: Double click on Pay creates two subscriptions. Severity: Major. Environment: Chrome on Windows and Safari on iPhone, test mode payments. Steps: sign in as a new user, choose the monthly plan, double click Pay on the checkout page. Expected: one subscription and one charge. Actual: two subscriptions created in the billing dashboard and two charges. Suggested fix: disable the button after the first click and make subscription creation idempotent on the server using the checkout session ID.

A finding written this way can be pasted straight into an AI tool. Reports that say only "payment is buggy" cost you time reproducing the problem. Ask for a sample QA report before you buy, just as you would for a security report.

Getting it checked

TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.

Get a scope for your app

Tell us what you built, what it stores and who is about to use it.

Get matched

Common questions

Is QA reported separately from security?

Often in one document with two sections. Security findings are ranked by attacker impact, QA bugs by user impact.

Do I get automated tests too?

Only if scoped. Ask; some testers deliver test scripts for the core flows.