Smart home or IoT app testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, the app opens a demo home without hardware, adds a real device and switches it on and off from the phone.Risks: store-rejection. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.penetration testingDone when: A tester with a leaked password list, a second account and access to the same Wi-Fi cannot view a camera feed, speak through it or change settings on a device they do not own.Risks: data-breach, fraud-abuse, user-harm. Tool class: proxy. Usually run by: external lab.
3. 3.end-to-end functional testsDone when: A sign-in from an unknown phone sends an alert to the owner, and with two-factor sign-in on, the same login fails without the second factor.Risks: fraud-abuse, user-harm. Tool class: mobile automation. Usually run by: QA engineer.
4. 4.compliance checksDone when: A signed record per device model shows a unique or user-set password, the published security update period and a vulnerability report contact before the model ships to a new country.Risks: regulatory-penalty. Tool class: test management. Usually run by: product manager.
5. 5.security scanningDone when: The scan of the app binary and device API shows no open high-severity finding and no account password or device key stored unencrypted on the phone.Risks: data-breach. Tool class: SAST scanner. Usually run by: security specialist.
6. 6.resilience and failure testingDone when: With the vendor cloud blocked, the app marks each device's last known state as stale, and queued schedules run once when the cloud returns.Risks: dependency-failure. Tool class: chaos tool. Usually run by: developer.
7. 7.device and browser compatibilityDone when: Device setup, local control and push alerts work on each phone model and OS version in the support list, including with the phone on a different Wi-Fi band from the device, and the demo home opens without hardware on each.Risks: lost-actions, store-rejection. Tool class: device cloud. Usually run by: QA engineer.
8. 8.offline and poor-network testingDone when: With the internet link cut but home Wi-Fi up, lock, light and thermostat commands from the app still work and the app says it is in local mode.Risks: lost-actions. Tool class: proxy. Usually run by: QA engineer.