Why ReGrade
Your suite passes and the release still breaks. Every test your team writes checks a behavior somebody predicted, and the regressions that reach customers are the ones nobody thought to predict. ReGrade compares real traffic across versions, field by field, and names what changed. Keep your existing tests and add recorded-traffic comparison where it provides useful evidence.
| Approach | What it verifies | What it can't see | How ReGrade complements it |
|---|---|---|---|
| Unit & integration tests | The specific behaviors somebody wrote an assertion for. | Behavior you never thought to assert on, the unknown unknowns. | Compares entire responses field by field, so unexpected differences surface without a written assertion. |
| Contract testing | Agreed API schemas and consumer/provider behavior described by the contract tests. | Behavior and side effects outside the contracts that the team has specified. | Compares the actual response content across versions, field by field. |
| Snapshot testing | That an output still matches a previously recorded snapshot. | Outputs and execution paths outside the captured snapshots; changed snapshots still need review. | Replays recorded traffic and applies mapping rules for changing values such as tokens and timestamps. Your team reviews the rules and remaining differences. |
| DAST & scanners | Potential vulnerabilities found through active attack payloads and passive inspection. | Application behavior outside scanner coverage, including some business-logic and authorization failures. | Found a real password-hash leak (CVE-2023-5968) with zero prior knowledge, from traffic alone. |
| Manual QA | Whatever a human thinks to click through, with real judgment. | Paths the team did not exercise; repeating large test scenarios takes time. | Turns recorded requests into repeatable comparisons against reference responses. |
ReGrade compares the requests you record against a reference version. Your team reviews differences and decides what should block a release. Unrecorded paths and vulnerabilities shared by both versions still need other testing.