Social network testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a new user signs up, posts, follows someone, reports a post and blocks a user.Risks: store-rejection. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.exploratory testingDone when: A session log from a test teen account shows that after engaging with self-harm and diet content the feed and search do not keep suggesting it, signed off by the trust and safety lead.Risks: user-harm. Tool class: test management. Usually run by: QA engineer.
3. 3.penetration testingDone when: A tester cannot obtain or reuse another user's session token through profile previews, shared links or the API, and a password reset signs every old session out.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: external lab.
4. 4.regression suiteDone when: After each release, privacy defaults for new teen and adult accounts match the approved settings list.Risks: regulatory-penalty. Tool class: mobile automation. Usually run by: QA engineer.
5. 5.compliance checksDone when: A signed review shows that an account registered with a minor's birth date starts private and cannot be messaged by strangers, and a sign-up with an under-13 birth date is blocked or sent to parental consent, with a screenshot for each market's rule.Risks: regulatory-penalty. Tool class: test management. Usually run by: product manager.
6. 6.analytics and event tracking testsDone when: A network capture shows phone numbers and emails collected for sign-in security never sent to advertising or analytics endpoints.Risks: regulatory-penalty. Tool class: proxy. Usually run by: product manager.
7. 7.security scanningDone when: The scan of the apps and public API shows no open high-severity finding, and profile endpoints return no private field to a non-follower.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
8. 8.end-to-end functional testsDone when: A reported post reaches the moderation queue, and a blocked user can no longer see or message the blocker, on iOS, Android and web.Risks: store-rejection. Tool class: mobile automation. Usually run by: QA engineer.