-
Testing
Test that my search and filters return the right results
Verify search queries, filters, and sorting return correct data, respect permissions, and don't leak other users' records.
Free Prompt
My app has search, filtering, or sorting, and I want tests proving they return the right things, because 'close enough' search results erode trust fast.
Find every search, filter, and sort feature and write tests covering:
1. Correctness: a search for a known term returns the records it should and excludes the ones it shouldn't. Test exact matches, partial matches, and case behavior.
2. Empty and special input: blank searches, searches with only whitespace, and searches full of special characters (`%`, `_`, quotes, regex-ish input) return sane results instead of crashing or dumping the entire table.
3. Permission scoping: filtered and searched results only include records the requesting user is allowed to see. This is the critical one. A search that returns other users' private records is a data leak with a UI.
4. Filter combinations: multiple filters applied together narrow results correctly instead of one silently overriding another.
5. Sorting: results come back in the requested order, including with ties, and sorting doesn't drop records.
6. Interaction with pagination (if my app paginates): filtering plus pagination returns correct totals and no duplicates or gaps between pages.
Seed the test database with a deliberate fixture set designed to expose mistakes: similar names, records belonging to different users, records differing only in the filtered field.
When finished, run the suite and report which behaviors hold and which leak, drop, or scramble results.
What This Does / How This Helps
This tests your search, filter, and sort features for correctness, injection-safe special character handling, permission scoping, and correct interaction with pagination. Search is where permissions quietly break. The list page might scope records to the current user while the search endpoint was generated separately and scopes nothing, and now anyone can find other users' data by guessing keywords. Special-character input is the other classic: a `%` in a LIKE query can turn a specific search into a full table dump. These tests pin both down.
Want to skip doing this by hand?
Fortivibe audits your app for all of the areas these prompts cover (and more).