Money
Prices, discounts, taxes, refunds, partial refunds, payouts and the ledger that records them. We buy, cancel, refund and retry, then check that the totals on the receipt, in the admin console and in the payment provider's dashboard agree to the last paisa or cent. Rounding and double-submits are the usual suspects.
Permissions
Who can see and change which records. We sign in as each role and try to open, edit and delete things that belong to someone else, through the screens and directly through the API. A hidden button is not a permission check; the server has to say no.
Notifications and background jobs
Push notifications, emails, reminders, scheduled reports and anything that runs at night. We check that each one fires once, at the right time, in the right time zone, to the right person, and that turning a notification off really turns it off.
Interrupted journeys
Real users get phone calls mid-payment, lose signal in a lift, switch apps to copy an OTP and press back at the worst moment. We interrupt every important journey on purpose and check that the product recovers without double charges, lost drafts or stuck screens.
Data over time
A screen that looks fine with three items breaks with three hundred. We test with a heavy account as well as an empty one: long lists, long names, old records, many photos and a year of history, because that is what the product looks like after its first good month.
Dates and time zones
Bookings, deadlines, reminders and reports all depend on dates, and dates break at boundaries: midnight, month end, daylight-saving changes and users in another country. We change the device's time zone and clock, book across midnight and run reports for the last day of the month.
Uploads and media
Photos from a phone camera, large PDFs, unusual file types, a slow connection and an upload cancelled halfway. We check what the user sees, what is stored, whether images are resized and rotated correctly, and whether a failed upload can be retried without creating duplicates.
Search, filters and sorting
Search that ignores a typo, a filter that forgets itself when you go back, sorting that breaks on the second page. We test with real-looking data, odd characters and empty results, and check that what the list says matches what the detail screen shows.
Account deletion and privacy
Store reviewers and privacy laws both expect users to be able to leave cleanly. We delete accounts and check what really happens to the data, check that exports contain what they should, and compare the privacy answers in the store listings with what the app actually collects.
Risk meters show where we most often find serious problems; they are our judgement, not a survey.
