QUALITY ASSURANCE • TRUE CARE SYSTEM
Security Testing
Test authentication, authorization, tenant isolation, sessions, input handling, and security controls.
QA artifacts may contain workforce identity, Provider configuration, PHI, GPS, visit, payroll, billing, audit, or integration evidence. Public documentation and shared test evidence must use synthetic, demonstration, or properly redacted information. Never place production passwords, tokens, full SSNs, bank account numbers, or unnecessary PHI in screenshots, tickets, automated test output, or repositories.
Purpose
Security testing evaluates the controls that protect accounts, PHI, Provider data, financial information, integrations, and administrative functions.
Security Test Areas
| Control | Validation |
|---|---|
| Authentication | Valid, invalid, disabled, expired, reset, OTP/MFA when enabled, and suspicious-login handling. |
| Authorization | Every route and API action rejects users without the required role or permission. |
| Provider isolation | Provider A cannot read, search, export, modify, receive alerts for, or infer Provider B data. |
| Session security | Logout, expiration, revoked session, impersonation end, refresh, and multi-tab behavior. |
| Input security | Server-side validation, parameter tampering, injection, XSS, unsafe files, and oversized uploads. |
| Sensitive data | Secrets and PHI are not exposed in logs, URLs, browser errors, or exports. |
| Support access | Ticket approval, expiration, Provider consent, actor identity, session start/end audit. |
Release Blocking Conditions
Any reproducible cross-tenant exposure, privilege escalation, PHI disclosure, credential exposure, unauthorized export, session bypass, destructive injection, or audit-evasion defect is release blocking.