Subscription box service testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: On the release build, a test subscriber signs up, skips the next box and cancels online, and the account shows no upcoming charge.Risks: money-loss, regulatory-penalty. Tool class: browser automation. Usually run by: QA engineer.
2. 2.data integrity and migration testingDone when: After each renewal run, the report shows no box shipped and no card charged for a skipped month or a cancelled or paused subscription, and no box queued for shipment on a subscription without a stored consent record.Risks: money-loss, regulatory-penalty. Tool class: data validation. Usually run by: QA engineer.
3. 3.integration testsDone when: Subscription status, next billing date and next shipment date match across the storefront, billing provider and fulfilment system after a skip, pause and cancel.Risks: money-loss. Tool class: API client. Usually run by: developer.
4. 4.payment and money-flow testingDone when: A renewal, a failed card with retries, a plan change mid-cycle and a cancellation before the billing date each leave the expected charges, and only those, on the test card statement.Risks: money-loss. Tool class: API client. Usually run by: QA engineer.
5. 5.end-to-end functional testsDone when: A subscriber who signed up on the website or app cancels in the same channel without calling support, and receives a cancellation confirmation email.Risks: regulatory-penalty. Tool class: browser automation. Usually run by: QA engineer.
6. 6.accessibility testingDone when: A screen reader user subscribes, skips a month and cancels using the keyboard alone.Risks: accessibility-liability. Tool class: accessibility checker. Usually run by: accessibility specialist.
7. 7.compliance checksDone when: A signed review of the checkout shows the price, renewal frequency and cancellation method next to the subscribe button, and a record of the subscriber's consent is stored.Risks: regulatory-penalty. Tool class: test management. Usually run by: product manager.
8. 8.security scanningDone when: The scan of the account and gift-redemption pages shows no open high-severity finding.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
9. 9.penetration testingDone when: A tester cannot read another subscriber's address or order history by changing a subscription id or guessing gift codes.Risks: data-breach. Tool class: proxy. Usually run by: security specialist.