# Test brief: video conferencing tool

Product type: video conferencing tool. Meetings with audio, video, screen share and recording.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/video-conferencing/
Printable checklist: https://howtotestaproduct.com/checklists/video-conferencing/

Run these 9 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: data-breach, store-rejection). Tool class: browser automation. Usually run by: QA engineer.
   Done when: On every build, each client installs from the store or notarized build without a warning, two test accounts on different platforms join a passcode meeting, see and hear each other, share a screen, the host ends the meeting for all, and after the desktop client is uninstalled a test web page can no longer start or join a meeting through it.
2. regression suite (risks: fraud-abuse, data-breach). Tool class: test management. Usually run by: QA engineer.
   Done when: The intruder, recording-access and uninstall cases rerun on every release, and any intruder join blocks the release.
3. penetration testing (risks: fraud-abuse, data-breach). Tool class: proxy. Usually run by: security specialist.
   Done when: A tester without an invite cannot join a passcode or waiting-room meeting by guessing IDs, and cannot open a cloud recording link without signing in as an allowed user.
4. end-to-end functional tests (risks: fraud-abuse). Tool class: browser automation. Usually run by: QA engineer.
   Done when: Waiting room, passcode, meeting lock, remove participant and host-only screen share each stop a test intruder account in a scripted meeting.
5. compliance checks (risks: regulatory-penalty, data-breach). Tool class: test management. Usually run by: product manager.
   Done when: Every security claim in marketing and in the app (encryption type, recording storage) matches a design document signed by a security specialist, and the release notes name every helper or local service the desktop installer adds.
6. accessibility testing (risks: accessibility-liability). Tool class: accessibility checker. Usually run by: accessibility specialist.
   Done when: A screen-reader user joins, mutes, raises a hand and reads chat by keyboard alone, and live captions appear for a speaking test user.
7. integration tests (risks: data-breach). Tool class: proxy. Usually run by: developer.
   Done when: A proxy capture of app open shows no third-party SDK sending device data before the user picks that SDK's feature.
8. security scanning (risks: data-breach). Tool class: SAST scanner. Usually run by: security specialist.
   Done when: The scan of client builds and the recording service has no open high findings, and the desktop installer leaves no local web server listening after uninstall.
9. device and browser compatibility (risks: store-rejection). Tool class: device cloud. Usually run by: QA engineer.
   Done when: The current and previous OS versions on iOS, Android, Windows and macOS install the client, pass notarization or store pre-checks, and join the same meeting.

Acceptance criteria wording:
A release of the video conferencing tool is accepted when two test accounts on different platforms join a passcode meeting, see and hear each other and share a screen, and a test intruder account is stopped by the waiting room, passcode, meeting lock and host-only screen share. Every encryption and recording claim matches a signed design document, and the desktop installer leaves no local web server listening after uninstall.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.