# Test brief: grocery delivery app

Product type: grocery delivery app. Grocery ordering with substitutions, slots and cold chain.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/grocery-delivery/
Printable checklist: https://howtotestaproduct.com/checklists/grocery-delivery/

Run these 8 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: store-rejection). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: On the release build, a shopper adds a weighed item and an out-of-stock item that offers a substitute, sees a full-slots message instead of a crash when every chilled delivery slot is taken, books an open one and pays with a test card.
2. payment and money-flow testing (risks: money-loss). Tool class: API client. Usually run by: QA engineer.
   Done when: A test order with a weighed item and a substitute, reported as delivered after its chilled slot ended, is refunded in full to the original test card in the sandbox when the guarantee promises a refund, not paid as a credit toward the next basket.
3. compliance checks (risks: regulatory-penalty, store-rejection). Tool class: test management. Usually run by: product manager.
   Done when: A signed checklist shows that free delivery wording, membership trial terms, consent before renewal and store privacy labels match what the app does.
4. end-to-end functional tests (risks: regulatory-penalty). Tool class: browser automation. Usually run by: QA engineer.
   Done when: On a first order advertised with free delivery, the checkout screen shows every fee before payment and the card charge equals the shown total.
5. accessibility testing (risks: accessibility-liability). Tool class: accessibility checker. Usually run by: accessibility specialist.
   Done when: A screen reader user and a keyboard-only user each fill a basket, choose substitutions, book a slot and pay without help on web and app.
6. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: The scan report for the apps and API lists no open high-severity finding, and one shopper cannot read another household's address, delivery slot or doorstep notes with their own sign-in.
7. penetration testing (risks: data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: The tester's report states they could not read another household's address, doorstep notes or order history from a shopper or picker account.
8. device and browser compatibility (risks: store-rejection). Tool class: device cloud. Usually run by: QA engineer.
   Done when: Basket, slot booking and checkout complete on the oldest and newest supported iOS and Android versions, including when every slot is full.

Acceptance criteria wording:
A release of the grocery delivery app is accepted when a first order advertised with free delivery shows every fee before payment and the card charge equals the shown total. A test order delivered after its chilled slot ended is refunded in full to the original card, not credited toward the next basket, when the guarantee promises a refund. A screen reader user and a keyboard-only user can each fill a basket, choose substitutions, book a slot and pay.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.