Search test cases, weighted to relevance and leaks

Permission filtering applied after retrieval is the most serious. The query returns everything matching the term, and the interface hides what the user should not see. It works until the result count, a facet total or an export reveals the volume, or until a small change bypasses the display filter entirely. Test by indexing a record in another tenant and searching for it directly at the API.

Stale index entries are the second. A record is deleted or unpublished, the index is not updated, and search continues to return the title and snippet of content that no longer exists. Verify deletion propagation, and time how long it takes.

Pagination instability is the third and generates the strangest bug reports. If the sort key is not unique, the database is free to order tied records differently on each query, so a record on page one can appear again on page two while another is skipped. Users report missing data, and nothing looks wrong in a single page test.

The fourth is the search echo. Rendering "results for" plus the raw query without escaping is a reflected cross site scripting vector that has existed for twenty years and still ships regularly, because the field itself validates fine and only the echo is unsafe.