Phase 10 · Audit & QA

▶Start here

You are here: Playbook → Phase 10 · Audit & QA This phase is for you if: you need proof the app is secure, fast, accessible, and complete before launch. Not this phase? Phase 9 = polish · Phase 11 = business go/no-go.

Run the end-to-end audit before anyone pays: prove the app is secure, fast, accessible, and functionally complete, then sign off. This phase is the last wide net — everything that follows assumes a clean bill of health.

Phase 10 — the audit & QA pipeline

Each stage gates the next. Sign-off is a hard stop: any unresolved CRITICAL keeps the launch closed.

Gate

The app is verified running (Phase 3) with all intended features present. You’re auditing a complete app, not building one. The exit gate is a clean pre-launch checklist with zero unresolved CRITICAL items.

How this phase runs

The audit splits into three movements: a static audit of the code and supply chain, a set of deep audits (security, performance, database, SEO, accessibility, cookies), and functional QA + debugger review that drives the running app. Treat them as gates in order — a passing static audit makes the deep audits trustworthy, and clean deep audits make functional sign-off meaningful.

Inspect → Plan → Approve → Fix

For any audit that changes code (performance, SEO, accessibility), inspect and document first, propose a fix plan, get approval, then fix. Never let an agent rewrite Blade views or run package updates unattended on a CodeCanyon tree.

Optional (SHOULD / OPTIONAL) tasks are never silently skipped. Surface what you’re skipping and let the operator decide; list skips at the end even in fast mode.

Pages in this phase

1 · Static audit Project structure, Composer audit, git hygiene, secrets scan — plus migration analysis and FVDUT storage classification.

2 · Security audit Headers, ownership-aware vulnerability decisions, exposed files, admin + storage hardening, vulnerability register.

3 · Performance, DB & SEO Core Web Vitals, index coverage + N+1 hunting, indexing/canonical/robots fixes.

4 · Accessibility & cookies WCAG 2.1 AA checks and GDPR/CCPA cookie inventory + consent verification.

5 · Functional QA + debugger Drive every journey/role (Playwright MCP), runtime security, then mine Telescope/Sentry/logs for hidden bugs.

6 · Pre-launch sign-off The final checklist + the launch sequence. Any unresolved high-risk item = do not launch.

Start with the Static audit.