1. Summary
App under test: QuickList v0.9.2 (Android APK, AI-generated
via a no-code app builder)
Tester: Indie App QA Sprint
Test window: 2026-09-11 14:00–2026-09-13 09:00 UTC
Devices: Pixel 6 (Android 14, physical device), Galaxy A13
(Android 12, physical device), Pixel 4a emulator (Android 11, 5.8" screen)
Scope: Onboarding, account creation, core list-management
flow, data persistence, settings, logout/session handling
Headline result: 1 critical bug blocks core usage for any list item with a long title. 1 high-severity bug allows account creation with an empty password, which is a real security exposure once this ships past a demo. 3 medium/low issues affect polish, not function. Full detail below.
2. Bug list
| ID | Severity | Summary | Repro rate |
|---|---|---|---|
| QL-01 | Critical | App crashes on save when list title > 80 characters | 10/10 attempts, both physical devices |
| QL-02 | High | Sign-up succeeds with an empty password field | 5/5 attempts, all devices |
| QL-03 | Medium | Pull-to-refresh resets manual item order to creation order | 3/5 attempts |
| QL-04 | Medium | Logout does not clear cached list data — old data briefly visible on next login as a different user | 4/6 attempts |
| QL-05 | Low | Settings gear icon misaligned ~4px on screens ≥768px wide | Visual, consistent |
3. Detail & repro steps
QL-01 — Critical — Crash on long list title
Steps to reproduce:
- Open QuickList, tap "New List"
- Enter a title longer than 80 characters (e.g. a pasted sentence)
- Tap "Save"
Expected: Either the input is capped at a sane length client-side, or the save succeeds with the full title.
Actual: App crashes immediately with an unhandled exception. Logcat shows a null pointer inside TitleValidator.truncate() — the validator assumes a maximum length that isn't enforced on the input field, so it indexes past the string bounds.
[evidence: logcat-QL01.txt, stack trace attached in full report]
Why it matters: Any user pasting a title from another app (common — people paste from Notes/Reminders) hits this immediately. This is a first-session crash risk, not an edge case.
QL-02 — High — Empty password accepted at sign-up
Steps to reproduce:
- Open sign-up screen
- Enter a valid email, leave password field blank
- Tap "Create account"
Expected: Client and/or server validation rejects an empty password with an inline error.
Actual: Account is created successfully with no password set. The account can subsequently be logged into by entering the email and leaving the password field blank.
[evidence: screenshot of successful login with blank password, login-QL02.png]
Why it matters: This isn't cosmetic — it's an authentication bypass in the generated auth scaffold. If this ships, any account is accessible to anyone who knows or guesses the email address.
QL-03 — Medium — Sort order reset on refresh
Manually reordering list items (drag-to-reorder) and then pulling down to refresh resets the list to creation-date order, discarding the user's manual sort. Reproduced 3 of 5 attempts — intermittent, likely a race between the local reorder write and the refresh fetch overwriting it before the write commits.
QL-04 — Medium — Stale data visible across accounts on shared device
Logging out of Account A and immediately into Account B briefly shows Account A's list data before the UI refreshes with Account B's data (roughly 1–2 seconds). On a shared or demo device this is a real privacy leak, not just a flicker.
QL-05 — Low — Settings icon misalignment
Cosmetic only. The settings gear in the bottom nav sits ~4px off-center on screens 768px and wider (tablets, foldables unfolded). Does not affect function.
4. UX friction log (non-bugs worth fixing)
- No loading indicator while a list saves — on a slow connection it's unclear whether "Save" registered, which invites duplicate taps.
- Error toast on failed save disappears after ~1.5 seconds, too fast to read the message on first occurrence.
- Onboarding skips explaining what "Lists" vs "Items" means in the data model, which is not obvious from the UI alone.
5. What held up (tested, not broken)
Core create/read/update/delete on list items functioned correctly outside the two bugs above. Session persistence across app restarts worked correctly on all three devices. Offline item creation queued and synced correctly once connectivity returned.
6. Fix-this-first summary
- QL-01 — cap title length client-side and fix the validator bounds check. Ships-blocking.
- QL-02 — enforce non-empty password server-side, not just client-side. Security-blocking.
- QL-03 and QL-04 — worth fixing before a public beta, not before an internal one.
- QL-05 — cosmetic, fix whenever convenient.
This sample is illustrative. A real report includes actual screen recordings and screenshots as file attachments alongside the written document, plus device/OS build numbers and exact app version tested.