- resolver: several groups, numbers stored as text, empty group sets, a code only at user level, booleans - migrations: every id once, the history applied twice, the unique code after a down and an up - personal API tokens: no application, no principal, invalid bodies, another user's token