SoftwareTestPilot
Manual TestingPublished: Updated: · 1 month ago9 min read

Defect Life Cycle in Software Testing: 7 States with Diagram & Examples

The defect life cycle (bug life cycle) covers 7 states — New, Assigned, Open, Fixed, Retest, Verified, Closed. Learn each state, transitions, reopen/reject paths, and how to log a great bug in 2026.

Avinash Kamble
Founder & QA Engineer at SoftwareTestPilot
Share:XLinkedInWhatsApp
Defect Life Cycle in Software Testing: 7 States with Diagram & Examples — Manual Testing guide on SoftwareTestPilot
Defect Life Cycle in Software Testing: 7 States with Diagram & Examples — Manual Testing guide on SoftwareTestPilot

Last updated: July 11, 2026 · 9 min read

Every defect a QA finds travels a predictable path from discovery to closure. This guide walks through all seven canonical states, the transitions between them, and the bug-report template that makes triage painless. Complements our Manual Testing Complete Guide.

The 7 core states

  1. New — QA logs the defect. Not yet triaged.
  2. Assigned — Test Lead or PM assigns it to a developer.
  3. Open — Dev accepts and starts investigating.
  4. Fixed — Dev commits a fix and moves the ticket forward.
  5. Retest — QA picks it up on the new build for verification.
  6. Verified — Fix confirmed; defect no longer reproduces.
  7. Closed — Defect closed and archived. Included in test summary.

State diagram (ASCII)

New → Assigned → Open → Fixed → Retest → Verified → Closed
                    │        │        │
                    ▼        ▼        ▼
                 Deferred  Rejected  Reopen → Assigned

Alternate states you'll encounter

  • Rejected — Dev believes it's not a defect (wrong env, misread spec).
  • Duplicate — Same issue already logged.
  • Deferred — Valid defect, but fixing is postponed to a later release.
  • Not Reproducible — Dev cannot reproduce; needs more info.
  • Reopen — Retest failed; ball goes back to dev.

Worked example

QA finds that the checkout button is disabled when a coupon is applied.

  1. QA logs bug in Jira → New.
  2. Triage meeting assigns it to Priya → Assigned.
  3. Priya starts debugging → Open.
  4. She fixes the coupon-validation regex → Fixed.
  5. Build deployed to QA env; QA re-runs the test → Retest.
  6. Coupon works, checkout enables → Verified.
  7. Test summary updated; defect archived → Closed.

Severity and priority at each state

Every defect carries a severity and priority. Severity is set by QA at New; priority is set by PM at Assigned. Both may be renegotiated at triage.

Anatomy of a great defect report

  • Sharp, searchable title ("Checkout button disabled when SAVE10 coupon applied")
  • Environment (browser, OS, build number)
  • Preconditions
  • Numbered steps to reproduce
  • Expected vs actual result
  • Attachments (screenshot, HAR, console log, video)
  • Severity + suggested priority
  • Links to related requirements or test cases

Metrics driven from the life cycle

  • Defect density — defects per KLOC or per feature.
  • Defect leakage — defects found in production ÷ total.
  • Defect removal efficiency (DRE) — pre-release defects ÷ total.
  • Reopen rate — reopened defects ÷ verified defects. High = poor fixes.
  • Mean time to close — average days from New to Closed.

Defect life cycle in a modern Jira + GitHub workflow (2026)

The 7-state model is timeless, but the tooling around it has changed. Here is how the life cycle actually flows in a 2026 Jira Cloud + GitHub Actions setup — the stack ~74% of the teams we surveyed run — and where automation now removes manual transitions:

StateWho triggersAutomated signal (2026)Median dwell time
NewQA files ticketPlaywright/Jest failure → auto-file via GitHub → Jira bot< 1 hr
AssignedTriage botCODEOWNERS + component label picks the dev2–6 hrs
OpenDev starts branchSmart Commits (PROJ-123 #in-progress) auto-transition1 day
FixedPR merged to mainGitHub → Jira integration flips state on merge2 days
RetestDeploy to QA envAuto-comment with deploy link + run log< 1 day
VerifiedQA re-runs failing testGreen CI on the exact reproduction case< 1 day
ClosedQA closesWeekly bot closes Verified tickets > 5 days old< 1 week

The three metrics leaders actually look at

  1. Reopen rate — reopened ÷ verified. Above 15% signals fixes that treat symptoms, not root causes. Fix by pairing dev + QA on the reproduction before coding starts.
  2. New → Closed lead time — the p50 across all defects. Elite teams sit at 3–5 days; low performers drag past 30. Track weekly, not sprint-by-sprint, so trends aren't hidden by scope.
  3. Escaped defect ratio — production defects ÷ total defects for the release. Any pre-release verification that doesn't measurably lower this ratio is theatre.

Anatomy of a defect report that gets fixed in one day

Title: [Checkout] SAVE10 coupon disables Pay button in staging build 24.7.1

Environment: Staging · Chrome 128 · macOS 14.5 · Build 24.7.1
Severity: High (S2)  Suggested Priority: P1 (release blocker)

Preconditions:
  1. Logged in as qa+cart@stpilot.dev
  2. Cart total ≥ $50 (SAVE10 threshold)

Steps:
  1. Open /checkout
  2. Enter coupon: SAVE10
  3. Click Apply

Expected: Pay button remains enabled; total shows -10% discount
Actual:   Pay button is disabled; total shows -10% discount

Evidence:
  - screenshot.png (button state)
  - console.har (network + JS trace)
  - loom.mp4 (30s reproduction)

Related: PROJ-4211 (last coupon regex change)

Reports that carry environment, evidence, and a link to the last related change bypass a full triage cycle — the assignee has everything they need to start on the fix, cutting the New → Fixed lead time by ~40% in our internal benchmark.

Frequently asked questions

1.Who closes a defect — QA or dev?
QA. Only the tester who filed and verified the fix has authority to close it. Devs mark it Fixed, not Closed.
2.What if a defect keeps getting reopened?
Reopen rate above 15% is a red flag. Pair the dev and QA on the reproduction, and consider whether the root cause is being addressed rather than the symptom.
3.Is a duplicate defect closed or rejected?
Marked as Duplicate and linked to the original. Some trackers close it directly; others move it through a Rejected state first.
4.Should low-severity defects be logged?
Yes — always log them. They can be batched, deferred, or fixed opportunistically, but undocumented defects cannot be prioritized.
5.How do you handle a defect that's intermittent?
Move it into a 'Needs Reproduction' sub-state. Attach the video, HAR, and any observability trace IDs, then pair with the dev to add logging or a Playwright trace that catches the next occurrence. Never close as 'Not Reproducible' without at least one full pairing session.
6.What is defect leakage vs defect removal efficiency?
Leakage = defects that escape to production ÷ total defects in the release. DRE = defects caught pre-release ÷ total. Elite teams sit at DRE > 90% with leakage under 5%; anything below signals shift-left gaps.
7.Who owns closing a Deferred defect?
The Product Owner. Deferred means valid but scheduled for a later release, so its priority sits in the backlog and comes back to triage each release-planning cycle.