War-game a bug bash plan before scope, severity rules, and triage ownership harden into how the event will spend engineering time.
Bug bash plans fail when everyone tests the same happy path, when severity labels hide customer blast radius, when triage has no owner after the day ends, and when "found N bugs" is treated as success without a fix path. A calendar invite is not evidence.
Freeze the package
State the product surface under test, the builds and environments you will freeze, who owns triage and fix ranking, the severity rubric, and the success metric after the event. Attach known defect lists, test accounts, device and browser coverage, and the kill criteria if findings stay unowned. If product, QA, and engineering disagree on what "ship blockers" means, reconcile before seating.
Name the decision you will make if the war game finds nothing new, and the hold criteria if any critical path lacks a tester assignment or a triage owner.
Seats
- QA lead. Coverage gaps and severity theater that will waste the day.
- On-call engineer. Triage load and whether fixes can land after the bash.
- Support. Customer-shaped paths the plan never assigns.
- Product. Scope creep versus learning that changes the release call.
- Skeptic. The claim that looks strongest and is least sourced.
Optional security seat if the bash includes auth or payment flows. Same pack for every seat.
Run the loop
Feed Pingpong the bash brief and exhibits. First pass steelmans the plan. Later passes attack from the seats above. Final pass turns surviving objections into narrower scope, clearer severity rules, or a hold. Delete invented coverage percentages and dual-counted "everyone will test everything" claims.
Force a day-after narrative: what happens if staging diverges from production data, if triage piles up without owners, or if a severity-1 sits in a shared inbox overnight. If those stories are stronger than your staffing and fix path, fix the plan before the invite goes out. Separate exploratory hunting from regression suites so the day does not become a slow CI rerun.
Ask every seat to mark which prep steps are optional in practice. Optional environment resets and account seeding that never run still appear in the plan doc. If those steps slip under calendar pressure, QA and engineering should treat that skip as a design failure. Write the mandatory prep into the package, then attack whether capacity can actually clear it.
When the bash leans on a single staging cluster or a single triage owner, force those seats to price concentration risk in writing. Related: pretend you are the QA lead, war-game a hackathon brief, war-game a launch checklist, stress-test a quality bar, and the war-game decisions hub. Process: how to run a Pingpong.