Pre-Launch QA Audit + Fix Plan

You are now acting as a senior QA engineer, product tester, security reviewer, mobile usability tester, and launch readiness auditor. Your job is to perform a complete QA test of this Base44 app before launch.

IMPORTANT: Do not start making changes immediately. Do not rewrite the app blindly, remove features, change the visual design unless a bug requires it, create duplicate systems, or guess how the app works. First inspect and understand the entire app. Find every issue that could break the app, confuse users, cause data loss, expose private data, create permission problems, hurt mobile usability, or make the app feel unfinished. After the audit, provide a full QA report first, then fix confirmed issues in a careful, staged way.

PHASE 1 — FULL APP UNDERSTANDING: Scan all pages, components, layouts, forms, routes, navigation, modals, dashboards, user flows, entities, backend functions, automations, integrations, permissions, role rules, file uploads, reports, public links, auth flows, and empty/loading/error states. Map app purpose, user types, workflows, data models, critical pages/actions, sensitive data areas, public/admin areas, and areas most likely to break. Don't fix anything until this map is complete.

PHASE 2 — QA TEST MATRIX: Create a matrix with page, role, feature, expected behavior, actual behavior, pass/fail, severity (Critical/High/Medium/Low), notes, recommended fix.

PHASE 3 — ROLE-BASED TESTING: Test as every role (Admin, Owner, Manager, Staff, Client, Customer, Guest, Public, plus any custom role). Verify users see and access only what they should, cannot reach private data via direct URLs or ID/param manipulation, and that navigation/dashboards/empty states/errors match the role.

PHASE 4 — AUTH & ACCOUNT: Test login, logout, register, invite, password reset, sessions, redirects, protected/public routes, unauthorized access, role redirects, broken auth states, expired sessions, profile loading. Look for wrong dashboards, logged-out users seeing protected data, admin pages visible to normal users, infinite loading, broken redirects, blank screens.

PHASE 5 — PAGE-BY-PAGE: For every page verify load, clarity, navigation, buttons, forms, filters, search, sorting, tabs, modals, dropdowns, tables, cards, correct record updates, empty/loading/error states, success messages, no broken links/dead buttons/duplicates, no placeholder text, no fake demo data shown as real. Report what works, fails, is confusing, or could block launch.

PHASE 6 — CRUD: Test create (validation, required fields, defaults, ownership, UI update, feedback), read (correct/scoped data, accurate details/lists/counts/totals/statuses/relationships), update (allowed fields only, saved correctly, UI refresh, timestamps, audit fields), delete (allowed users only, confirmation, correct record, no incorrect cascade, UI update). Include soft-delete behavior.

PHASE 7 — FORM VALIDATION: Verify required field marking/enforcement, email/phone/URL/number/date/file validation, character limits, whitespace-only rejection, duplicate handling, field-level errors in plain language, success messages, double-submit prevention, loading states, no data loss on error. Test edge cases (empty, very long, special chars, emojis, quotes, HTML/script tags, negative/zero/large numbers, past/future dates, duplicates, invalid/missing files, slow/failed upload).

PHASE 8 — MOBILE-FIRST: Test at 320/375/390/414/768px and desktop. Verify no horizontal scroll, cut-off buttons, overlapping text, tiny tap targets, hidden fields, broken headers/nav/sidebars, unusable tables, overflowing modals, off-screen dropdowns, stretched images. Recommend converting non-mobile-friendly tables into stacked cards.

PHASE 9 — DESKTOP: Test sidebar/top nav, dashboard layout, tables, wide screens, modal sizing, multi-column layouts, form alignment, card grids, report previews, admin/settings. Look for stretched layouts, awkward empty space, misaligned cards, broken grids, poor hierarchy.

PHASE 10 — NAVIGATION & ROUTING: Test all nav/sidebar/header/footer links, breadcrumbs, back/cancel buttons, detail/edit links, public/shared links, redirects, 404 and unauthorized behavior. Verify no broken/duplicate/wrong routes, correct back/cancel context, users never trapped, and public links don't expose private areas.

PHASE 11 — DATA RELATIONSHIPS: Review every relationship. Verify related records load and filter correctly, users can't see unrelated records, deleting one record doesn't break another, child records display under the correct parent, counts/totals match, and reports pull correct related data. Look for orphaned records and missing ownership fields.

PHASE 12 — PERMISSION & SECURITY: Review role access, ownership, tenant/client isolation, admin-only data, public/shared link access, file/upload access, delete/edit permissions, backend function permissions, direct URL access, and server-side protection. Look for normal users viewing admin data, clients viewing others' records, editing unowned records, exposed file URLs, backend trusting client input, manipulable IDs, frontend role spoofing, and missing ownership checks. For each issue explain what's exposed, who can access it, why it's dangerous, how to reproduce, and how to fix.

PHASE 13 — FILE UPLOAD & MEDIA: Test upload, drag-drop, mobile/camera upload, multi-file, preview, delete, replace, progress, error handling, large files, invalid types, empty uploads, correct record linkage, persistence after refresh, no wrong-user/record exposure, private file protection, aspect ratios. Test slow/interrupted uploads, duplicate filenames, broken/deleted image behavior.

PHASE 14 — REPORT/EXPORT/DOCUMENT: Verify accurate data, correct entity/dates/photos/notes/signatures/statuses, clean layout on mobile/desktop, working download/print/PDF/export, protected private report links, no placeholder/missing-data labels, graceful handling of long text/many images/no images/incomplete data. Look for wrong records, missing/broken images, incorrect totals, bad page breaks, overflow, and reports visible to the wrong person.

PHASE 15 — SEARCH/FILTER/SORT/TABLE: Verify correct results, no-results handling, clearing, case-insensitivity, filters alone and combined, date/status/role/category filters, sorting, pagination, table/bulk actions, empty/loading states. Test partial words, special characters, spaces, combined filters, sort-after-filter, and refresh with active filters.

PHASE 16 — NOTIFICATIONS/EMAILS/AUTOMATIONS: Verify correct timing/recipient, correct subjects/body/links, status-change/assignment/reminder/public-link/admin-alert emails, failed automation handling, no duplicates, role/ownership respect. Look for missing/duplicate notifications, wrong recipients, broken links, stale status, sensitive data to the wrong person, automations running too often or not at all.

PHASE 17 — INTEGRATIONS: For each integration test connection setup, missing/invalid API key behavior, successful/failed/slow requests, timeouts, errors, retries, data mapping, duplicate prevention, logging, user feedback, and key security. Never expose API keys in the frontend or UI.

PHASE 18 — AI FEATURES: Verify inputs work, output is useful/formatted/saved/placed correctly, no accidental data overwrite, handling of empty/bad/long input and missing context and failed responses, loading/error states, user review before use, and no cross-user data exposure. Check prompt quality, context passed, output structure, fallback, and regeneration behavior.

PHASE 19 — OFFLINE/SYNC/RELIABILITY: If applicable, verify data saves online and after refresh, drafts preserved, pending sync visible and eventually synced, failed sync errors + retry, no data loss on connection drop, no duplicate records on retry, correct file/record sync, safe local data clearing. Test create online/offline, weak-connection upload, refresh during save, double submit, leaving during save, reopening with pending sync.

PHASE 20 — ERROR HANDLING: Check handling of failed load/save/update/delete/upload/login/permission/function/API, missing/deleted/unauthorized records, empty/invalid/slow responses, network failure. Every error needs a clear message, no scary technical text, no blank screen, no infinite spinner, no broken layout, a clear next step, and retry where appropriate.

PHASE 21 — PERFORMANCE: Check slow pages, heavy components, repeated data calls, unnecessary re-renders, large unpaginated lists, unoptimized images, missing dimensions/lazy loading, unused imports/components, heavy libraries, over-fetching, dashboards loading too much, slow reports, mobile performance. Recommend lazy loading, pagination, query/image optimization, fewer repeated calls, code removal, component splitting, better loading states. Don't change design unless needed.

PHASE 22 — ACCESSIBILITY: Check labeled buttons/links/forms, placeholders not used as the only label, readable errors, sufficient contrast and font sizes, keyboard navigation, visible focus states, closable modals, icon labels, image alt text, color not the only status indicator, marked required fields. Look for tiny text, low contrast, icon-only actions, confusing labels, hidden focus, bad tap targets.

PHASE 23 — CONTENT/COPY/POLISH: Check typos, grammar, placeholder text, inconsistent labels/buttons/capitalization/status names, confusing errors, visible developer notes, incomplete instructions, unclear empty/success messages and headings. Make the app feel finished and professional.

PHASE 24 — LAUNCH READINESS: Create a checklist (critical blockers, high-priority, medium, low polish, security/mobile/data/performance concerns, missing feedback/empty/error states/permission checks, risky workflows) and a launch readiness score (90–100 ready; 75–89 almost; 60–74 not ready; below 60 do not launch) with a clear explanation.

PHASE 25 — QA REPORT FORMAT: Produce the report with: App Summary, User Roles Found, Critical User Flows, QA Test Matrix table, Bugs Found (title, severity, page/component, role affected, repro steps, expected/actual, likely cause, fix, launch impact), Security/Permission Issues, Mobile Issues, Data/Sync Issues, Performance Issues, UX/Polish Issues, Launch Readiness Score, and a Fix Plan grouped into fix-before-launch / fix-soon-after / optional. Do not fix anything until this report is complete.

PHASE 26 — FIXING RULES: After the report, fix in order: critical security/permission, data loss, broken core workflows, broken forms, broken mobile, broken uploads, broken reports, error handling, performance, UX polish. Make the smallest safe change; preserve structure/design/components/entities/permissions; no duplicate pages or data models; don't remove working features; don't change business logic unless required; don't expose private data or weaken permissions. Explain each group of fixes.

PHASE 27 — POST-FIX REGRESSION: Retest affected areas; confirm the original bug is gone and no new permission/mobile/data/route/layout issue was introduced. Create a final regression report (issue fixed, how, retest result, remaining risk, final status).

FINAL OUTPUT: Full QA report, bugs, security/mobile/data/performance/UX issues, launch readiness score, fixes completed, remaining recommendations, and a final recommendation (Ready to launch / Ready after minor fixes / Not ready yet / Do not launch until critical issues fixed). Be extremely thorough — treat this app as preparing for real customers, real data, payments, private information, and public launch.