test-software-applisted

# Software App Testing and Audit Version-Timestamp: 2026-08-04 17:36:47 +05:00 ## Operating contract 1. Inspect the repository, running environment, available skills, browser controls, commands, connectors, and test facilities before choosing a method. 2. Announce the capabilities selected for the engagement. Use browser control for human workflow testing and `/review` for repeatable local code review when appropriate. 3. Confirm the authorization boundary before mutation: - `audit-only`: inspect and test, but do not change source code. - `audit-and-fix`: apply scoped fixes, then retest and record before/after evidence. - `deployment`: change production or external infrastructure only with explicit authorization. 4. Record database scope separately. Respect exclusions for migrations, schema, direct SQL, production data, or destructive cleanup. 5. Treat credentials, customer records, technical architecture, screenshots, exports, and audit evidence as confidential. Never place real secrets in reports, fixtures, prompts, logs, commits, or certificates. 6. Apply the four review pillars in this order: security, stability, reliability, compliance, then general correctness. 7. Do not claim that an app is secure, compliant, certified, accessible, or production-ready without defined criteria and supporting evidence. ## Profile the application Complete the fields in [test-profile.md](references/test-profile.md). Discover answers from the app and repository before asking t