Make monday.com work with Microsoft 365 & SharePoint →
Test Management logo

Test Management

Appvibe

265 installs, since December 10, 2023.   13 installs/month.   Updated October 4, 2024.

Free No touch
Gallery image Gallery image Gallery image

Professional Test Management: Plan, Execute, and Collaborate

Struggling to keep your test cases organized and streamline your QA process? Finding it challenging to ensure thorough test coverage and accurate reporting? Our Professional Test Management app provides a comprehensive solution to transform your QA process. Native to monday.com, this advanced tool allows you to create, manage, and execute test cases with ease. 


Ready to see it in action? Request a demo now and discover how our Professional Test Management solution can transform your test management.


Plan, Execute, and Organize with Precision

  • Create and Manage Test Cases: Organize manual and automated tests with customizable fields and workflows.
  • Execute Test Plans: Carry out testing steps and track results across multiple environments seamlessly.
  • Organized Test Library: Structure your tests in folders and groups for easy access and management.
  • Advanced Planning: Plan, track, and manage your tests with detailed test plans and ad-hoc executions.


Collaborate Effectively with Your Team

  • Team Collaboration: Work with your QA and development teams to review and approve test cases, ensuring quality and compliance.
  • Failed Test Visibility: Easily notify teammates about failed tests to complete the workflow and resolve issues promptly.
  • Real-Time Dashboards: Access live dashboards for a complete view of your testing activities.


Comprehensive Reporting

  • Detailed Reporting: Generate in-depth reports on test coverage, progress, and results.
  • Live Dashboards: Access real-time data for a comprehensive view of your testing status.
  • Traceability Reports: Link requirements, test cases, and defects for full traceability and compliance.
  • Customizable Reports: Tailor reports to meet your specific needs and share insights with stakeholders.


Enterprise-Grade Security and Privacy

  • 2,000+ businesses rely on Appvibe, including Amazon, Uber, Accenture, and Facebook
  • Commitment to GDPR
  • CAIQ compliance
  • SOC 2 compliance in review
  • Learn more about our security and trust policies


Unlock the full potential of your QA process with our comprehensive test management solution. Join thousands of satisfied customers and streamline your testing activities today. For more information and to get started, explore our documentation.

Security & Compliance

Security

Does the developer periodically perform penetration testing?

Yes
Yes, we perform regular penetration tests. We also use continuous monitoring tools to ensure robust security across our system.

Does the developer have a dedicated security and privacy point of contact for such issues or questions?

Yes

Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?

Yes
Our app only allows redirects to a select few destinations and does not permit users to determine or add a redirect destination. Additionally, we verify user input data before authorizing any operations, such as forwards or redirects, and we validate the URLs/destinations, permitting only those on the approved list.

Does the app protect against mass parameter assignment attacks?

Yes
Our monday.com app safeguards against mass parameter assignment attacks by: a) Whitelisting Parameters: Only allowing modifications to predefined and whitelisted parameters. b) Strong Parameter Validation: Ensuring data received is of expected type, format, and range. c) Authentication and Authorization: Requiring users to authenticate and checking their permissions before processing user data. d) Object-Level Security: Ensuring users can only modify authorized objects within their monday.com workspace. These combined measures ensure robust protection against mass parameter assignment attacks.

Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?

Yes
To prevent XSS (Cross-Site Scripting) attacks, we implement the following measures for encoding and sanitizing all user-supplied parameters where relevant: a) Input Validation: We validate all user input to ensure it conforms to expected formats and does not contain any malicious code or characters. b) Output Encoding: We encode all user-supplied data before rendering it in the HTML output. This ensures that any potentially malicious code inserted by the user is treated as plain text and not executable script. c) Use of Content-Security-Policy (CSP) Header: We implement CSP headers to restrict the sources from which content can be loaded and executed by the browser. d) Use of Sanitization Libraries: We use established libraries and frameworks that have built-in sanitization features to automatically sanitize user input and protect against XSS attacks.

Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?

Yes
To protect all state-changing actions against CSRF (Cross-Site Request Forgery), we implement a combination of measures depending on relevancy for the app. Most of this is done by the frameworks we use and include the following: a) Use of Anti-CSRF Tokens: We generate unique tokens for each session and include them in forms and AJAX requests. The server verifies the token before processing any state-changing request. b) Same-Site Cookies: We set the 'SameSite' attribute for cookies to 'Strict' or 'Lax' to ensure the browser only sends the cookie in a first-party context. c) Checking the Origin and Referer Headers: We validate the origin and referer headers of the HTTP request to ensure it came from a trusted domain. d) Requiring Authentication: For any state-changing action, we require the user to be authenticated and authorized. e) Implementing Security Headers: We implement HTTP security headers like Content-Security-Policy (CSP) to control the sources from which content can be loaded.

Does the developer have mechanisms to notify monday.com in case of a security breach?

Yes
In case of a security breach we would do the following: a) Assessment: Immediately assess the nature, scope, and potential impact of the breach. b) Notification: Notify monday.com within 24 hours of discovering the breach via email or phone call, providing all available details of the breach, including its nature, the data affected, potential consequences, and measures taken to address it. c) Updates: Provide continuous updates as more information becomes available and as additional steps are taken to address the breach. d) Compliance: Ensure compliance with all legal and regulatory requirements for data breach notification.

Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?

Yes
We approach application level updates and security patched with the following steps: a) Monitor: Keep an eye out for any updates or security patches for your software. b) Evaluate: Decide if the updates are necessary and plan when to install them. c) Backup: Make a copy of your data and settings before updating. d) Test: Try the updates in a test environment to make sure they work properly. e) Deploy: Install the updates in the real (production) environment.

Compliance

Is the app certified with the information security standard ISO/IEC 27001:2022?

Not answered

Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?

No

Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?

No

Is the app compliant with the General Data Protection Regulation (GDPR)?

Yes

Data

Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).

Not answered

Where does the app store logs data?

Not answered

Where does the app store the app data?

Not answered

Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?

Yes
We ensure logs do not contain secrets or personally identifiable information (PII) by: a) Log Sanitization: Before logs are written, we sanitize the data to remove any sensitive information by filtering out known sensitive fields and replacing them with placeholder values. b) Use of Logging Libraries: We use logging libraries and frameworks designed to automatically mask or remove sensitive information from logs. c) Regular Audits: Logs are regularly audited to ensure that no sensitive data has inadvertently been logged. Automated tools help in scanning through large volumes of logs to identify any potential leaks. d) Employee Training: Employees are trained to recognize sensitive data and to avoid logging such information inadvertently. They are also trained on how to use the logging libraries and frameworks correctly to ensure sensitive data is automatically removed or masked.

Is customer data segregated from the data of other customers (for example logically or physically)?

Yes
Although customer data shares the same database schema, we ensure data isolation through stringent logical segregation. Each customer is assigned a unique identifier used in all database requests, ensuring access only to their own data. Robust access controls, authentication mechanisms, and regular security audits are in place to maintain the integrity and effectiveness of our data segregation measures.

Privacy

Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?

Yes
Our employees use Multi-Factor Authentication (MFA) for accessing systems that process or hold customer data, which is hosted on AWS. AWS MFA involves the use of two different factors for authentication: something you know (your AWS account password) and something you have (an authentication device). This ensures that even if one's password is compromised, an attacker would still need access to the authentication device to gain access to the AWS resources.

Does the developer protect access to customer data based on the principle of least privilege?

Yes
Access to customer data at our company is limited to: a) Customer Support: Limited access for resolving customer issues. b) Operations and IT: Access for maintaining and managing infrastructure. c) Management: Access to aggregated and anonymized data for strategic decisions. Access is based on the principle of least privilege.

Reviews

February 13, 2025

JC: Not easy to see how to configure, help docs are worthless and making contact with a human being is impossible. Not good signs when trying to add an app to our Monday install, passing on it and go back to Excel files.

April 10, 2024

IB: useless app- test runs are only one time run

Installation history

We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.

ID: 10000358App ID: 10111509Listing updated: September 11, 2024