Test revenue paths first — login, subscription upgrade, permission boundaries, and webhook handlers. Cosmetic UI tests come after.
- Feature tests over unit tests for APIs
- RefreshDatabase trait in CI
- Stripe webhook tests with fake payloads
- Policy tests for multi-tenant IDOR
- Run tests on every PR