Travel booking app testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a traveller searches, books a test hotel and a test flight, pays and receives both confirmations.Risks: store-rejection. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.integration testsDone when: A cancellation or schedule change sent by each connected supplier appears on the traveller's booking and opens a refund case.Risks: money-loss. Tool class: API client. Usually run by: developer.
3. 3.payment and money-flow testingDone when: A test flight cancelled by the supplier sandbox produces a refund to the original test card, shown on the traveller's trip page.Risks: money-loss. Tool class: API client. Usually run by: QA engineer.
4. 4.compliance checksDone when: A signed checklist shows how results are ranked is disclosed, scarcity banners match supplier data, and store privacy labels match the data collected.Risks: regulatory-penalty, store-rejection. Tool class: test management. Usually run by: product manager.
5. 5.end-to-end functional testsDone when: The first nightly price shown for a hotel equals the checkout total with all mandatory fees for the same dates.Risks: regulatory-penalty. Tool class: browser automation. Usually run by: QA engineer.
6. 6.accessibility testingDone when: A screen reader user picks dates on the fare calendar, chooses a seat and pays for a test flight without help.Risks: accessibility-liability. Tool class: accessibility checker. Usually run by: accessibility specialist.
7. 7.security scanningDone when: The scan report for the apps and booking API lists no open high-severity finding on the trip lookup by booking reference or on stored passport details.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
8. 8.penetration testingDone when: The tester's report states they could not open another traveller's trip or passport details by guessing or changing a booking reference.Risks: data-breach. Tool class: proxy. Usually run by: security specialist.
9. 9.device and browser compatibilityDone when: Search, booking and the trip page work on the oldest and newest supported iOS and Android versions, including dates where the supplier returns no availability.Risks: store-rejection. Tool class: device cloud. Usually run by: QA engineer.