Is there some formal way(s) of quantifying potential flaws, or risk, and ensuring there’s sufficient spread of tests to cover them? Perhaps using some kind of complexity measure? Or a risk assessment of some kind?
Experience tells me I need to be extra careful around certain things - user input, code generation, anything with a publicly exposed surface, third-party libraries/services, financial data, personal information (especially of minors), batch data manipulation/migration, and so on.
But is there any accepted means of formally measuring a system and ensuring that some level of test quality exists?
I’d like to see state space coverage instead of line coverage. That, at least, catches silly “100%” cases.
I don’t know of a tool that provides this metric. I don’t even think such a thing could be made for most languages. still, useful to think about when reviewing code.