QA Checklist Before Your MVP Launch: 47 Things to Test

You have one chance to make a first impression with your first 10 users. A critical bug in the signup flow or a broken payment does not just lose a user — it loses the referral they would have made.

Authentication (8 checks)

• New user can sign up with email/password
• Welcome/verification email arrives within 2 minutes
• Verification link works correctly
• Duplicate email shows appropriate error (not "500 Internal Server Error")
• Password reset flow works end-to-end
• Logged-out user is redirected to login when accessing protected routes
• Persistent session works across browser restarts
• Logout terminates the session

Core User Flow (6 checks)

• New user can complete the primary action within 2 minutes of signing up
• The aha moment (first value delivery) happens in onboarding
• Empty states have helpful messaging and a clear CTA
• Primary flow works on mobile Safari (iOS)
• Primary flow works on Chrome Android
• Primary flow works on desktop Chrome and Safari

Forms and Validation (6 checks)

• Required fields show clear error messages when left blank
• Error messages are human-readable
• Success actions give clear feedback (toast, redirect, or confirmation)
• Form fields do not auto-submit on Enter when they should not
• Long text inputs do not break the layout
• Phone number fields handle international formats

Payments (7 checks)

• Test subscription with Stripe test card (4242 4242 4242 4242)
• Failed payment with test card (4000 0000 0000 0002) shows user-friendly error
• User receives payment confirmation email
• Invoice is accessible in account settings
• Upgrade and downgrade flows work
• Cancellation flow works and sets correct end date
• Webhook events are handled (subscription created, payment failed, cancellation)

Navigation and Routing (5 checks)

• All navigation links work (no 404s on primary nav)
• Back button behavior is sensible
• Deep links work (shared URL takes user to right page)
• 404 page exists and is helpful
• Breadcrumbs reflect the current page

Performance (5 checks)

• First Contentful Paint under 2.5 seconds on simulated mobile (Lighthouse)
• No layout shift after load (CLS < 0.1)
• Images compressed and served in WebP
• API responses return within 500ms for primary actions
• No console errors on page load

Security (5 checks)

• Authenticated routes are inaccessible without valid session
• API endpoints validate authorization — user A cannot access user B's data
• No sensitive data (API keys, passwords) in client-side JavaScript
• Forms protected against XSS
• HTTPS enforced

Email (3 checks)

• Transactional emails arrive in under 2 minutes
• Emails render correctly in Gmail web and mobile
• Emails do not land in spam for new Gmail accounts

Legal (2 checks)

• Privacy policy and terms of service pages exist and are linked in the footer
• Cookie consent is present if required

The Two Devices You Must Test On:

1. An iPhone (Safari, current iOS)
2. An Android phone (Chrome, current Android)

Desktop-only testing is not enough. A $200–300 investment in a freelance QA tester to run this checklist can save your launch.