# Scoped application security test plan

Blank work product. Replace bracketed fields with system-specific facts. Unknown evidence stays unknown; do not mark a control passed because a template is complete.

## Authorization and scope

- Authorizing owner / window / environment: [record]
- Product revision / artifact / deployed configuration: [identity]
- Allowed hosts, APIs and test accounts: [explicit list]
- Prohibited actions, request limits and stop conditions: [limits]
- Evidence handling, redaction and deletion date: [rules]
- Versioned baseline and selected requirement IDs: [only verified IDs]
- Exclusions and untested surfaces: [list]

## Test design

| Test ID | Requirement / invariant | Actor / data fixture | Procedure | Expected response AND effect | Evidence to retain | Status |
| --- | --- | --- | --- | --- | --- | --- |
| [ID] | [one claim] | [synthetic setup] | [repeatable steps] | [positive/negative] | [request, state, revision] | [not run] |

Include legitimate requests, denied requests, alternative routes, boundary values, expiry/revocation, retries and concurrency where applicable. A skipped case stays skipped.

## Results and exit decision

Record actual results, confidence, defects, retest run and changed scope. Report requirement status with evidence, not merely a passed-test percentage. Name blocking failures, unresolved evidence and who decides release.