# Testing checklist: social network

Source: https://howtotestaproduct.com/how-to-test/social-network/
Generated: 2026-10-07. Licence: CC BY 4.0.

- [ ] 1. release smoke tests
  - Done when: On the release build, a new user signs up, posts, follows someone, reports a post and blocks a user.
  - Risks: store-rejection
  - Tool class: mobile automation. Usually run by: QA engineer.
- [ ] 2. exploratory testing
  - Done when: A session log from a test teen account shows that after engaging with self-harm and diet content the feed and search do not keep suggesting it, signed off by the trust and safety lead.
  - Risks: user-harm
  - Tool class: test management. Usually run by: QA engineer.
- [ ] 3. penetration testing
  - Done when: A tester cannot obtain or reuse another user's session token through profile previews, shared links or the API, and a password reset signs every old session out.
  - Risks: data-breach, fraud-abuse
  - Tool class: proxy. Usually run by: external lab.
- [ ] 4. regression suite
  - Done when: After each release, privacy defaults for new teen and adult accounts match the approved settings list.
  - Risks: regulatory-penalty
  - Tool class: mobile automation. Usually run by: QA engineer.
- [ ] 5. compliance checks
  - Done when: A signed review shows that an account registered with a minor's birth date starts private and cannot be messaged by strangers, and a sign-up with an under-13 birth date is blocked or sent to parental consent, with a screenshot for each market's rule.
  - Risks: regulatory-penalty
  - Tool class: test management. Usually run by: product manager.
- [ ] 6. analytics and event tracking tests
  - Done when: A network capture shows phone numbers and emails collected for sign-in security never sent to advertising or analytics endpoints.
  - Risks: regulatory-penalty
  - Tool class: proxy. Usually run by: product manager.
- [ ] 7. security scanning
  - Done when: The scan of the apps and public API shows no open high-severity finding, and profile endpoints return no private field to a non-follower.
  - Risks: data-breach
  - Tool class: DAST scanner. Usually run by: security specialist.
- [ ] 8. end-to-end functional tests
  - Done when: A reported post reaches the moderation queue, and a blocked user can no longer see or message the blocker, on iOS, Android and web.
  - Risks: store-rejection
  - Tool class: mobile automation. Usually run by: QA engineer.