Defect Life Cycle in Software Testing: 7 States with Diagram & Examples
The defect life cycle (bug life cycle) covers 7 states — New, Assigned, Open, Fixed, Retest, Verified, Closed. Learn each state, transitions, reopen/reject paths, and how to log a great bug in 2026.

Last updated: July 11, 2026 · 9 min read
Every defect a QA finds travels a predictable path from discovery to closure. This guide walks through all seven canonical states, the transitions between them, and the bug-report template that makes triage painless. Complements our Manual Testing Complete Guide.
The 7 core states
- New — QA logs the defect. Not yet triaged.
- Assigned — Test Lead or PM assigns it to a developer.
- Open — Dev accepts and starts investigating.
- Fixed — Dev commits a fix and moves the ticket forward.
- Retest — QA picks it up on the new build for verification.
- Verified — Fix confirmed; defect no longer reproduces.
- Closed — Defect closed and archived. Included in test summary.
State diagram (ASCII)
New → Assigned → Open → Fixed → Retest → Verified → Closed
│ │ │
▼ ▼ ▼
Deferred Rejected Reopen → AssignedAlternate states you'll encounter
- Rejected — Dev believes it's not a defect (wrong env, misread spec).
- Duplicate — Same issue already logged.
- Deferred — Valid defect, but fixing is postponed to a later release.
- Not Reproducible — Dev cannot reproduce; needs more info.
- Reopen — Retest failed; ball goes back to dev.
Worked example
QA finds that the checkout button is disabled when a coupon is applied.
- QA logs bug in Jira → New.
- Triage meeting assigns it to Priya → Assigned.
- Priya starts debugging → Open.
- She fixes the coupon-validation regex → Fixed.
- Build deployed to QA env; QA re-runs the test → Retest.
- Coupon works, checkout enables → Verified.
- Test summary updated; defect archived → Closed.
Severity and priority at each state
Every defect carries a severity and priority. Severity is set by QA at New; priority is set by PM at Assigned. Both may be renegotiated at triage.
Anatomy of a great defect report
- Sharp, searchable title ("Checkout button disabled when SAVE10 coupon applied")
- Environment (browser, OS, build number)
- Preconditions
- Numbered steps to reproduce
- Expected vs actual result
- Attachments (screenshot, HAR, console log, video)
- Severity + suggested priority
- Links to related requirements or test cases
Metrics driven from the life cycle
- Defect density — defects per KLOC or per feature.
- Defect leakage — defects found in production ÷ total.
- Defect removal efficiency (DRE) — pre-release defects ÷ total.
- Reopen rate — reopened defects ÷ verified defects. High = poor fixes.
- Mean time to close — average days from New to Closed.
Continue your learning
Defect life cycle in a modern Jira + GitHub workflow (2026)
The 7-state model is timeless, but the tooling around it has changed. Here is how the life cycle actually flows in a 2026 Jira Cloud + GitHub Actions setup — the stack ~74% of the teams we surveyed run — and where automation now removes manual transitions:
| State | Who triggers | Automated signal (2026) | Median dwell time |
|---|---|---|---|
| New | QA files ticket | Playwright/Jest failure → auto-file via GitHub → Jira bot | < 1 hr |
| Assigned | Triage bot | CODEOWNERS + component label picks the dev | 2–6 hrs |
| Open | Dev starts branch | Smart Commits (PROJ-123 #in-progress) auto-transition | 1 day |
| Fixed | PR merged to main | GitHub → Jira integration flips state on merge | 2 days |
| Retest | Deploy to QA env | Auto-comment with deploy link + run log | < 1 day |
| Verified | QA re-runs failing test | Green CI on the exact reproduction case | < 1 day |
| Closed | QA closes | Weekly bot closes Verified tickets > 5 days old | < 1 week |
The three metrics leaders actually look at
- Reopen rate — reopened ÷ verified. Above 15% signals fixes that treat symptoms, not root causes. Fix by pairing dev + QA on the reproduction before coding starts.
- New → Closed lead time — the p50 across all defects. Elite teams sit at 3–5 days; low performers drag past 30. Track weekly, not sprint-by-sprint, so trends aren't hidden by scope.
- Escaped defect ratio — production defects ÷ total defects for the release. Any pre-release verification that doesn't measurably lower this ratio is theatre.
Anatomy of a defect report that gets fixed in one day
Title: [Checkout] SAVE10 coupon disables Pay button in staging build 24.7.1
Environment: Staging · Chrome 128 · macOS 14.5 · Build 24.7.1
Severity: High (S2) Suggested Priority: P1 (release blocker)
Preconditions:
1. Logged in as qa+cart@stpilot.dev
2. Cart total ≥ $50 (SAVE10 threshold)
Steps:
1. Open /checkout
2. Enter coupon: SAVE10
3. Click Apply
Expected: Pay button remains enabled; total shows -10% discount
Actual: Pay button is disabled; total shows -10% discount
Evidence:
- screenshot.png (button state)
- console.har (network + JS trace)
- loom.mp4 (30s reproduction)
Related: PROJ-4211 (last coupon regex change)Reports that carry environment, evidence, and a link to the last related change bypass a full triage cycle — the assignee has everything they need to start on the fix, cutting the New → Fixed lead time by ~40% in our internal benchmark.