Your Own Browser Is the Worst Instrument You Own for Testing Your Own Site

There is a category of bug that is invisible to the person best placed to fix it, and the reason is structural rather than careless.

The clearest example is the login redirect loop. Your app finds no valid session and redirects to /login. The login page believes it is signed in and redirects back. Round and round, until the browser gives up.

It reproduces for every new visitor. It never reproduces for you, because your session cookie was set weeks ago and is working fine.

You cannot see it, and no amount of care makes you able to. You are in a state the affected person is not in, and you cannot leave it by looking harder.

The reflex, and what it actually covers

The reflex is a private window, and it is a good reflex. It clears cookies, storage and cache, which is genuinely most of the client-side state that makes you unrepresentative.

Here is what it does not touch.

Your account. If the bug depends on a user with old data, an unusual permission set, or a record created before a migration, a private window gives you a signed-out browser and the same database. Sign in again and you are back in your own privileged, well-seeded, three-years-old account.

Your feature flags and experiment buckets. If assignment is by user id rather than by cookie, a private window changes nothing. You are in the variant you were always in. If it is by cookie, you get a random new one, which is not the same as getting the one the reporter had.

Your network position. Same ISP, same resolver, same country, same corporate proxy, same VPN. A regional CDN problem, a DNS record that has not propagated everywhere, or a firewall that only affects one network are all untouched by which window you opened.

Your CDN edge. Your nearest edge node has been warmed by your own traffic for months. A visitor hitting a cold edge somewhere else gets a different first-byte time and, if something is misconfigured, sometimes a different response entirely.

Your device. Same OS, same browser build, same fonts, same locale, same timezone, same screen, same accessibility settings. Every layout bug that only happens at a particular width, and every date bug that only happens across a timezone boundary, is still invisible.

So a private window resets the client, and a large share of what makes your experience unrepresentative was never in the client.

Worth knowing what you are carrying

If you want to see how much local state you are actually holding on a site, this is quick, and the answer is usually more than people expect:

// Run in the console on your own site, in a normal window.
console.log('cookies:', document.cookie.split('; ').filter(Boolean).length)
console.log('localStorage keys:', Object.keys(localStorage))
console.log('sessionStorage keys:', Object.keys(sessionStorage))

navigator.serviceWorker?.getRegistrations()
  .then(rs => console.log('service workers:', rs.map(r => r.scope)))

caches?.keys().then(ks => console.log('cache storage:', ks))

A service worker is the one that catches people out. It can serve a cached shell to you indefinitely while every new visitor gets the current one, which means you and they are running different versions of the front end with no version number anywhere to say so.

What this means for a bug report

The practical consequence is not "test more carefully". It is that for a whole class of bugs, the reporter is holding evidence you cannot regenerate.

Not their opinion of what went wrong. The state: which build they had, what their cookies said, what the network actually returned, what was in the console at the moment it failed. Once they close the tab, most of it is gone, and the gap between "it works for me" and "it does not work for me" becomes an argument neither side can settle.

Which is why "can you try again and tell me if it still happens" is such an expensive question. It asks the one person with the evidence to destroy it and produce a fresh copy, from a state that may not reproduce.

The cheaper question is the one that captures what they had while they still have it. And the cheapest habit, when a report arrives that you cannot reproduce, is to stop treating your own failure to reproduce as evidence. It mostly tells you that you are a different user on a different network on a different machine, which you already knew.