Desktop application testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: The signed installer opens on clean macOS and Windows machines with no Gatekeeper or SmartScreen warning, and lists the same files and services as the previous release plus documented changes.Risks: store-rejection, data-breach. Tool class: device cloud. Usually run by: QA engineer.
2. 2.penetration testingDone when: A hostile web page opened in each supported browser cannot launch the app, join a session or read app data through a local port or URL handler.Risks: data-breach, regulatory-penalty. Tool class: proxy. Usually run by: security specialist.
3. 3.compliance checksDone when: Each build passes notarization and Microsoft Store certification, and release notes name every helper, service or login item the update installs.Risks: store-rejection, regulatory-penalty. Tool class: test management. Usually run by: product manager.
4. 4.end-to-end functional testsDone when: After install, update and uninstall on a test machine with redirected Documents and a moved data folder, every user file is still present and no helper remains.Risks: data-corruption, data-breach. Tool class: device cloud. Usually run by: QA engineer.
5. 5.regression suiteDone when: Install, update, uninstall and local-port cases rerun before each release, and any new listening port or deleted user file blocks it.Risks: data-corruption, data-breach. Tool class: test management. Usually run by: QA engineer.
6. 6.device and browser compatibilityDone when: Install, update and uninstall cases pass with no Gatekeeper or SmartScreen warning on each supported macOS, Windows and Linux version and on both Intel and Arm machines where offered.Risks: store-rejection, data-corruption. Tool class: device cloud. Usually run by: QA engineer.
7. 7.unit testsDone when: In the test report, the cleanup and repair code refuses to delete the home folder, the root folder, an empty path or any folder the app did not create.Risks: data-corruption. Tool class: unit framework. Usually run by: developer.
8. 8.security scanningDone when: A port and process scan of a test machine after install shows no listening service beyond those in the docs, and the bundled runtime has no known critical advisory.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
9. 9.data integrity and migration testingDone when: A test profile with known files keeps the same file list and contents before and after each update, including files saved in redirected folders.Risks: data-corruption. Tool class: data validation. Usually run by: QA engineer.