ShopLite: a free buggy web app to practise software testing
A small online shop with 30 deliberate bugs in its pages and API. Run it on your own computer with one command, find the bugs, and automate the checks. Free and open source.
Run it only on your own computer. It is full of bugs on purpose and must not be put on the public internet.
Run it in one command
Unzip the download, open a terminal in the folder, then use either way:
# With Docker
docker compose up --build
# Or with Node.js 20 or newer
npm install
npm startThen open http://localhost:3001. A demo account ([email protected]) is on the login page.
What you get
- A web shop: products, search, cart, coupons, checkout, orders and a profile page.
- A JSON API behind it, ready for Postman or code.
- 30 planted bugs. The count and the areas are public; the answers are not.
- A
BUGS=noneswitch that gives a fixed build, so you can check that your own tests pass on a healthy app. - A starter Playwright project with six passing tests and eight exercises.
- The same idea in Python: a pytest starter project with seven passing tests, bug-catching tests, and a GitHub Actions workflow.
Where the bugs are
| Area | Bugs | What to look at |
|---|---|---|
| Validation | 6 | What the forms and API accept that they should not |
| Status codes | 5 | Responses that say the wrong thing about what happened |
| Authentication and access | 5 | Logins, tokens, roles and who can see whose data |
| Pagination, sorting and search | 5 | Lists that skip, repeat, miscount or sort oddly |
| Calculations | 5 | Discounts, tax, shipping and stock |
| User interface | 4 | Things the page shows that do not match what happened |
| Total | 30 |
How to use it
- Explore for 30 minutes as a customer and note anything odd.
- Write test cases for each feature. Use the login page test cases as a model.
- Test the API with Postman or code: bad input, no token, someone else's id.
- Report what you find with the bug report template.
- Automate the checks and run them against the fixed build and the buggy one.
Want the answers and a finished project?
The Portfolio Project Kit has the full bug list with reproduction steps, a test plan, test cases, a complete Playwright and API framework that catches every bug, and a guide to explaining the project in interviews.
See the kitQuestions
Is ShopLite really free?
Yes. The app, its README and starter test projects (TypeScript and Python) are free and open source under the MIT licence. Only the full answer key and the finished test framework are in the paid Portfolio Project Kit.
Where should I run it?
On your own computer only. It contains deliberate bugs, some security-related by design, so it must not be put on the public internet. The Docker setup binds it to localhost.
How do I know when I have found all the bugs?
The README tells you there are 30 in six areas. You can also run the app in a fixed mode (BUGS=none) and check that your tests pass there and fail on the normal build. The kit has the full list with reproduction steps.
Do I need to know programming?
No, to explore and report bugs by hand. To automate the checks you will want basic Java, Python or JavaScript. The starter projects use Playwright with TypeScript, and pytest with Python.