Online marketplace testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a buyer finds a listing, reports it, blocks the seller and completes a purchase from another seller.Risks: store-rejection. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.end-to-end functional testsDone when: A test seller crosses the volume threshold, is asked for verification, and has listings paused until verified; a buyer report on a listing reaches the trust team queue.Risks: fraud-abuse, regulatory-penalty. Tool class: browser automation. Usually run by: QA engineer.
3. 3.penetration testingDone when: A tester signed in as seller A cannot read seller B's buyers, orders or payout account, or change another seller's bank details, by editing ids, and a seller account set up with a tax ID that does not match the seller's verified name cannot receive a payout.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: security specialist.
4. 4.compliance checksDone when: A signed checklist shows that sellers above the volume threshold are verified, and that their name, address and a report link show on every listing on web and app.Risks: regulatory-penalty, fraud-abuse. Tool class: test management. Usually run by: product manager.
5. 5.exploratory testingDone when: A session log records attempts at fake-seller onboarding, refund abuse, off-platform payment requests in messages and review manipulation, with the platform's response to each.Risks: fraud-abuse. Tool class: test management. Usually run by: QA engineer.
6. 6.data integrity and migration testingDone when: A daily ledger report shows, for every order, buyer charge equal to seller payout plus fees plus refunds, and lists every high-volume seller with verified details.Risks: regulatory-penalty. Tool class: data validation. Usually run by: QA engineer.
7. 7.security scanningDone when: The scan of the buyer and seller APIs shows no open high-severity finding, and payout bank-detail changes require re-authentication.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.