Stock trading app testing checklist

Download the checklistMarkdownCSVBrief (Markdown)

1. 1.release smoke testsDone when: After each release, a test account logs in, sees live quotes, places and cancels a market and a limit order, and the order history shows both.Risks: store-rejection, money-loss. Tool class: mobile automation. Usually run by: QA engineer.
2. 2.unit testsDone when: Buying power, margin and options collateral calculations match a reviewed table for cash, margin and options accounts, including after a partial fill.Risks: wrong-decisions, money-loss. Tool class: unit framework. Usually run by: developer.
3. 3.penetration testingDone when: An external tester cannot place an order or change the linked bank in another customer's account, and support tooling cannot export account data without a second approver.Risks: data-breach, fraud-abuse. Tool class: proxy. Usually run by: external lab.
4. 4.payment and money-flow testingDone when: In the sandbox, a deposit whose ACH pull is returned removes the instant buying power, freezes withdrawal and flags the account for review.Risks: fraud-abuse, money-loss. Tool class: API client. Usually run by: QA engineer.
5. 5.end-to-end functional testsDone when: A market order placed in a fast-moving test symbol either fills or shows the customer, before submission, that it will be converted to a limit order.Risks: money-loss. Tool class: mobile automation. Usually run by: QA engineer.
6. 6.compliance checksDone when: A test applicant who fails the options eligibility rules is refused options trading, and the refusal and the answers given are stored for review.Risks: regulatory-penalty. Tool class: test management. Usually run by: product manager.
7. 7.security scanningDone when: The latest scan of the trading API and the support console shows no open finding that exposes account holder data.Risks: data-breach. Tool class: DAST scanner. Usually run by: security specialist.
8. 8.performance and load testingDone when: At the login and order volume of the busiest market open on record, login, quotes and order entry respond within the targets agreed with the broker's operations team.Risks: outage-under-load. Tool class: load generator. Usually run by: developer.
9. 9.resilience and failure testingDone when: When the market data feed or the order router is cut in a test environment, the app shows an outage banner and blocks new orders instead of accepting them silently.Risks: outage-under-load. Tool class: chaos tool. Usually run by: developer.
10. 10.device and browser compatibilityDone when: The order ticket opens and submits on the oldest and newest iOS and Android versions the app supports, and the login, quote and order ticket screens open without a crash.Risks: store-rejection. Tool class: device cloud. Usually run by: QA engineer.
11. 11.data integrity and migration testingDone when: Cash balance, buying power and position values on the app match the clearing firm's end-of-day records for a set of test accounts, including accounts with open options.Risks: wrong-decisions. Tool class: data validation. Usually run by: QA engineer.