Skip to content

Services Work Insights About

Start a project

hindbrain

EXPLORE HINDBRAIN

Services Work Insights About

Start a project

Services Work Insights About Start a project

Testing playbook

Pre-launch testing checklist

The same list as in the playbook, ready to print. Ticks are saved in this browser and shared with the playbook page. Enter the project name and date, then print or save as PDF.

Back to the playbook

Only this checklist is printed, together with the signature block.

Project nameDate

Progress0 / 42

0

ItemOwner

Preparation

Written scope: domains, API, apps, test environmentOwner: Together
Signed consent to test with a time window and emergency contactOwner: Together
Access list handed overOwner: Client
Test accounts for every roleOwner: Client
Staging with test data, separate from productionOwner: Client
API documentation or an endpoint listOwner: Client
One-page threat model: data, attacker, moneyOwner: Hindbrain

Backend

Endpoints match the documentation, including response codesOwner: Hindbrain
Invalid input returns a clear error, not a crashOwner: Hindbrain
Migrations and data consistency checkedOwner: Hindbrain
Permissions: no role sees another role's dataOwner: Hindbrain
Typical load does not break responsesOwner: Hindbrain
Backup restore tested and timedOwner: Together

Web

Key paths in Chrome, Firefox, Safari and EdgeOwner: Hindbrain
WCAG 2.2 AA accessibility: keyboard, contrast, screen readerOwner: Hindbrain
Layout works from phone to large screenOwner: Hindbrain
Error states: offline, empty list, expired sessionOwner: Hindbrain

Desktop app

Install and uninstall leave no tracesOwner: Hindbrain
Automatic and manual updateOwner: Hindbrain
System permissions: only what is neededOwner: Hindbrain
Offline work and return to online without data lossOwner: Hindbrain
App signing certificate deliveredOwner: Client

Mobile app

Test builds for iOS and AndroidOwner: Client
Tested on real devices, both platformsOwner: Hindbrain
Permissions: camera, location, notificationsOwner: Hindbrain
Memory, battery and weak networkOwner: Hindbrain
App Store and Google Play requirements checkedOwner: Together
OWASP MASVS review: keychain, pinning, logsOwner: Hindbrain

Integration and security

Dependency, secret, image and SAST scans runOwner: Hindbrain
Authorization: IDOR and privilege escalation checked manuallyOwner: Hindbrain
Input validation: SQLi, XSS, SSRF, file uploadOwner: Hindbrain
Secrets, cloud MFA and IAM permissions reviewedOwner: Together
GDPR: processing register and processor agreementsOwner: Client

Acceptance tests

Acceptance scenarios agreedOwner: Together
Client walked through the scenarios on stagingOwner: Client
Acceptance test protocol signedOwner: Client

Report and retest

Findings report with CVSS ratings deliveredOwner: Hindbrain
Critical and high fixes doneOwner: Together
Retest done, fixed or open status in the reportOwner: Hindbrain

Go-live decision

No open critical findingsOwner: Together
Go-live decision made by the clientOwner: Client
Report, access and documentation handed to the clientOwner: Hindbrain

Signatures

Client

Full name

Signature

Date

Hindbrain

Full name

Signature

Date

hindbrain

Ideas engineered for what’s next.

Services Work Insights About Start a project

Cookie policy Privacy policy

© 2026 Hindbrain

Your privacy, your choice.

Essential cookies keep this site working. With your permission, optional cookies help us understand visits and measure campaigns. You decide what to allow.