Stage 10 — Sources & Further Learning (the curated library)
Goal: one page of trusted sources so you never wonder “where do I learn X?” Everything free unless marked 💰. This is the reading/watching list behind the whole roadmap.
📖 The official foundations
| Source | What it’s for |
|---|---|
| ISTQB CTFL Syllabus (free PDF) | THE standard vocabulary & concepts — read it even if you skip the exam 💰(exam only) |
| ISTQB Glossary | Settle any terminology debate in seconds |
| ISO/IEC/IEEE 29119 (overview) | Know it exists; enterprises reference it |
📚 Books that shaped this roadmap (💰 but worth every cent)
| Book | Why | Best at stage |
|---|---|---|
| Lessons Learned in Software Testing — Kaner, Bach, Pettichord | 293 hard-won lessons; the testing mindset book | 0–2 |
| Explore It! — Elisabeth Hendrickson | The definitive guide to exploratory testing & charters | 1 |
| Agile Testing + More Agile Testing — Lisa Crispin & Janet Gregory | QA inside agile teams, quadrants, whole-team quality | 4 |
| How Google Tests Software — Whittaker, Arbon, Carollo | How QA scales at giant companies | 6+ |
| Perfect Software and Other Illusions About Testing — Gerald Weinberg | What testing can and cannot promise — give it to your managers | 9 |
| The Design of Everyday Things — Don Norman | Usability instincts that make your UX bugs sharper | 3 |
🌐 Sites & blogs — the daily reads
| Source | What you get |
|---|---|
| Ministry of Testing | The QA community hub — articles, The Club forum, TestBash talks (some 💰) |
| Test Automation University | Completely free structured courses, manual → automation, with certificates |
| Satisfice blog (James Bach) | Rapid Software Testing school — sharpens your thinking |
| DevelopSense (Michael Bolton) | Testing vs checking, deep craft essays |
| Guru99 Software Testing | Beginner-friendly walkthroughs of every concept |
| Software Testing Help | Tutorials + tool comparisons |
| BrowserStack Guide Hub | Practical cross-browser/mobile testing guides |
| Kaner’s testing courses (BBST) | Free university-grade testing course materials |
| MDN Web Docs | When you need to understand how the web actually works |
🧪 Practice targets — safe places to test for real
| Target | Practice |
|---|---|
| the-internet.herokuapp.com | Every tricky UI element: iframes, dynamic loads, auth, uploads |
| saucedemo.com | A full mock store — perfect for your portfolio test suite |
| automationexercise.com | E-commerce with signup/cart/checkout flows + API list |
| DemoQA | Forms, widgets, interactions |
| OWASP Juice Shop | Deliberately vulnerable app — security testing playground |
| restful-booker | An API built to be tested with Postman — auth, CRUD, bugs included |
| ReqRes & JSONPlaceholder | Instant fake APIs for request practice |
| Postman Learning Center | Official API-testing curriculum |
| uTest / Testlio | Paid crowdtesting — real experience while job hunting |
🎥 Watch & listen
| Source | Format |
|---|---|
| Ministry of Testing YouTube | Conference talks — watch one TestBash talk weekly |
| Test Guild podcast (Joe Colantonio) | Weekly automation & QA interviews |
| AB Testing podcast | Alan Page & Brent Jensen — modern quality thinking |
| Testing Peers | QA leadership & career conversations |
| AZADEMY | My channel — practical QA/tech careers, real interview content, learning-meets-earning |
📬 Stay current
- Software Testing Weekly — the one newsletter to subscribe to
- Ministry of Testing newsletter — community happenings
- LinkedIn: follow James Bach, Michael Bolton, Lisa Crispin, Janet Gregory, Angie Jones, Nicola Lindgren, and working testers who post real bugs
🤖 AI for QA — tools, docs & learning (2026)
The fastest-moving area in testing. Curated, current, mostly free.
| Resource | What it’s for |
|---|---|
| Playwright MCP (official) | The server that lets AI agents drive a real browser — start here for agentic testing |
| Model Context Protocol docs | What MCP is and how to wire tools to AI clients |
| Playwright docs — Test agents | Official planner/generator/healer agent workflow |
| Claude Code / Cursor | MCP-capable clients that drive Playwright — where you’ll actually run agents |
| promptfoo | Free, QA-friendly LLM eval + red-teaming framework — best first eval tool |
| DeepEval | “PyTest for LLMs” — unit-test-style evals |
| OpenAI Evals | Reference eval framework & registry |
| Langfuse | Tracing + evals for LLM apps |
| OWASP Top 10 for LLM Apps | Security of AI systems — prompt injection & friends |
| Anthropic — building effective agents | How agentic systems are designed (so you know what to test) |
| Ministry of Testing — AI in Testing | Community discussion & talks on AI-assisted QA |
🔌 API testing — deep resources
| Resource | What it’s for |
|---|---|
| Postman Learning Center | The official, complete API-testing curriculum — free |
| freeCodeCamp Postman course | 2–3h beginner-to-testing video, hands-on |
| restful-booker | Buggy CRUD+auth API built for practice |
| OpenAPI Specification | The API contract standard — read the basics |
| Swagger tools | Explore & try APIs from their spec |
| Spectral | Lint OpenAPI specs (contract quality) |
| Pact — consumer-driven contracts | The contract-testing approach interviewers ask about |
| HTTP status codes (MDN) | The reference you’ll reopen forever |
| GoRest / ReqRes | Free auth-token & quick-request practice APIs |
🔐 Security testing — learn it hands-on
| Resource | What it’s for |
|---|---|
| PortSwigger Web Security Academy | THE free security-testing training — labs for every vuln, by the Burp team |
| OWASP Top 10 | The canonical risk list — required reading |
| OWASP WSTG | The professional Web Security Testing Guide/checklist |
| OWASP Juice Shop | Deliberately vulnerable app + challenge scoreboard |
| OWASP crAPI | Vulnerable API for API-security practice |
| OWASP ZAP | Free open-source intercepting proxy + scanner |
| Burp Suite Community | Free edition for manual security testing |
| TryHackMe / HackTheBox | Gamified, legal hands-on security (free tiers) |
💼 QA careers in the AI era
| Resource | What it’s for |
|---|---|
| Test Automation University | Free structured path from manual → automation → AI-assisted |
| Ministry of Testing — jobs & community | Where QA careers get discussed and posted |
| OpenAI Evals cookbook | Practical eval recipes — the AI-QA skill in demand |
| roadmap.sh — QA | A visual skills roadmap to compare against this one |
| Follow on LinkedIn | Angie Jones, Lisa Crispin, Janet Gregory, James Bach, Michael Bolton — and post your own learning |
📈 Market note (2026): research shows companies find it harder to hire people who can evaluate AI than build it — and QA people are natural evaluators. AI-fluent QA roles (AI QA Engineer, AI Evals Engineer, LLM Auditor) carry a real pay premium. The gap is your opportunity — see Stage 11.
🗺️ Per-stage reading map
| After stage… | Go deeper with |
|---|---|
| 0 Foundations | ISTQB syllabus ch. 1–2 · Guru99 basics track |
| 1 Techniques | Explore It! · BBST Test Design course |
| 2 Artifacts | Lessons Learned ch. on bug advocacy · MoT bug-report articles |
| 3 Testing types | BrowserStack guides · OWASP Top 10 overview · WCAG quickref |
| 4 Agile | Agile Testing · Scrum Guide (free, 14 pages) |
| 5 Tools | Postman Learning Center · Chrome DevTools docs · SQLBolt (free interactive SQL) |
| 6 Career | How Google Tests Software · MoT career stories |
| 7 Interviews | Glassdoor QA question banks · mock sessions with peers from The Club |
| 8 Automation | Test Automation University (start: “Web Element Locator Strategies”) · Playwright docs |
| 9 Soft skills | Perfect Software · Crucial Conversations 💰 |
| 11 AI × QA | Playwright MCP · promptfoo · OWASP Top 10 for LLMs |
| 12 API | Postman Learning Center · restful-booker · OpenAPI basics |
| 13 Security | PortSwigger Academy · OWASP Juice Shop · OWASP Top 10 |
A promise about this list: everything here is something I’ve read, used, or verified exists and delivers. No affiliate links, no filler. If a link dies, open an issue.
← Back to the roadmap