diff --git a/TEST_COVERAGE_GAPS.md b/TEST_COVERAGE_GAPS.md
new file mode 100644
index 0000000..3d8a8ae
--- /dev/null
+++ b/TEST_COVERAGE_GAPS.md
@@ -0,0 +1,420 @@
+# Test Coverage Gaps - StrategIQ
+
+This document outlines areas that need additional test coverage. Each section should be converted to a GitHub issue for tracking.
+
+## 🚨 High Priority - Critical Path
+
+### Issue: E2E Test for Complete Analysis Flow
+**Priority**: High
+**Effort**: Medium
+
+**Description**:
+Need end-to-end test that covers the complete workflow:
+1. User submits analysis form
+2. Background Celery task processes analysis
+3. Status updates via HTMX polling
+4. Final SWOT results rendered
+5. PDF download triggered
+
+**Current Coverage**: Individual endpoints tested, but not full integration
+**Gap**: No test covering Celery worker, real AI agent execution, complete flow
+
+**Suggested Tests**:
+- `test_complete_analysis_workflow_e2e()` - Mock AI agent, verify full flow
+- `test_analysis_with_real_celery_worker()` - Integration with Celery
+- `test_multiple_concurrent_analyses()` - Session isolation
+
+---
+
+### Issue: AI Agent Testing
+**Priority**: High
+**Effort**: Large
+
+**Description**:
+AI agent (Claude/GPT) has no test coverage. Need tests for:
+- SWOT analysis generation
+- Tool use (Reddit intelligence)
+- Fallback behavior when APIs fail
+- Rate limiting handling
+- Output validation
+
+**Current Coverage**: None
+**Gap**: Core business logic untested
+
+**Suggested Tests**:
+- `test_swot_agent_generates_valid_analysis()` - Mock API responses
+- `test_swot_agent_tool_use()` - Verify Reddit tool integration
+- `test_swot_agent_handles_api_errors()` - Error handling
+- `test_swot_agent_validates_output()` - Pydantic validation
+- `test_swot_agent_retries()` - Retry logic on failures
+
+---
+
+### Issue: HTMX OOB Swap DOM Validation
+**Priority**: Medium
+**Effort**: Medium
+
+**Description**:
+Current tests verify HTML content but don't validate DOM structure for OOB swaps.
+
+**Current Coverage**: Response HTML contains expected strings
+**Gap**: No validation that OOB swaps produce correct DOM structure
+
+**Suggested Tests**:
+- `test_status_oob_swap_creates_correct_dom()` - Parse HTML, verify structure
+- `test_status_timeline_container_has_correct_id()` - Regression test for #status-timeline
+- `test_multiple_oob_swaps_append_correctly()` - Sequential swaps
+
+**Tools**: Use BeautifulSoup or lxml to parse HTML and validate structure
+
+---
+
+## 🔒 Security Testing
+
+### Issue: Input Validation and Sanitization
+**Priority**: High
+**Effort**: Small
+
+**Description**:
+Need tests for malicious input handling.
+
+**Gaps**:
+- SQL injection attempts (parameterized queries should prevent)
+- XSS in entity names
+- SSRF via URL inputs
+- Path traversal in file operations
+- Secrets leakage in logs/errors
+
+**Suggested Tests**:
+- `test_sql_injection_prevention()` - Try SQL injection payloads
+- `test_xss_prevention_in_templates()` - Verify template escaping
+- `test_ssrf_protection()` - Block internal IPs, localhost
+- `test_no_secrets_in_logs()` - Verify API keys not logged
+- `test_rate_limiting()` - Prevent abuse
+
+---
+
+### Issue: PDF Security Testing
+**Priority**: Medium
+**Effort**: Small
+
+**Description**:
+PDF generation could have security implications.
+
+**Gaps**:
+- PDF bomb (extremely large file generation)
+- Memory exhaustion via large SWOT lists
+- Malicious input in PDF content
+- Cache poisoning
+
+**Suggested Tests**:
+- `test_pdf_size_limits()` - Reject oversized content
+- `test_pdf_generation_timeout()` - Prevent hanging
+- `test_pdf_cache_isolation()` - Prevent session leakage
+- `test_pdf_content_sanitization()` - No script injection
+
+---
+
+## ⚡ Performance Testing
+
+### Issue: Load Testing
+**Priority**: Medium
+**Effort**: Large
+
+**Description**:
+No performance tests exist.
+
+**Gaps**:
+- Concurrent requests handling
+- Database connection pooling
+- Cache effectiveness
+- Memory leaks
+- Celery queue saturation
+
+**Suggested Tests**:
+- `test_concurrent_analysis_requests()` - Locust or pytest-benchmark
+- `test_database_connection_limits()` - Connection pool testing
+- `test_cache_hit_ratio()` - Verify caching effectiveness
+- `test_memory_usage_stable()` - Check for leaks
+- `test_celery_worker_capacity()` - Queue performance
+
+---
+
+### Issue: PDF Cache Performance
+**Priority**: Medium
+**Effort**: Small
+
+**Description**:
+PDF cache has no memory limits or eviction policy.
+
+**Current Coverage**: Basic cache operations tested
+**Gap**: No tests for cache limits, eviction, memory pressure
+
+**Suggested Tests**:
+- `test_pdf_cache_max_size_limit()` - Enforce max cache size
+- `test_pdf_cache_eviction_policy()` - LRU or FIFO
+- `test_pdf_cache_memory_usage()` - Monitor memory consumption
+- `test_pdf_cache_cleanup_effectiveness()` - Verify old entries removed
+
+---
+
+## 🗄️ Database Testing
+
+### Issue: Database Operations
+**Priority**: Medium
+**Effort**: Medium
+
+**Description**:
+No tests for database operations.
+
+**Gaps**:
+- SWOT analysis persistence
+- Database migrations
+- Query performance
+- Transaction handling
+- Concurrent writes
+
+**Suggested Tests**:
+- `test_save_swot_analysis_to_db()` - Persist results
+- `test_retrieve_swot_analysis_from_db()` - Load by ID
+- `test_database_transaction_rollback()` - Error handling
+- `test_concurrent_database_writes()` - Race conditions
+- `test_database_migration_reversibility()` - Up/down migrations
+
+---
+
+## 🎨 Frontend Testing
+
+### Issue: Jinjax Component Testing
+**Priority**: Low
+**Effort**: Small
+
+**Description**:
+Jinjax components have no direct tests.
+
+**Gaps**:
+- StatusItem component rendering
+- StatusTimeline component rendering
+- Component parameter validation
+- Template syntax errors
+
+**Suggested Tests**:
+- `test_status_item_component_renders()` - Direct component test
+- `test_status_timeline_component_renders()` - Container test
+- `test_component_with_invalid_params()` - Error handling
+- `test_all_referenced_templates_exist()` - Regression prevention
+
+---
+
+### Issue: Accessibility Testing
+**Priority**: Medium
+**Effort**: Medium
+
+**Description**:
+No accessibility tests exist.
+
+**Gaps**:
+- WCAG 2.1 AA compliance
+- Keyboard navigation
+- Screen reader compatibility
+- ARIA label correctness
+- Color contrast validation
+
+**Suggested Tests**:
+- `test_wcag_aa_compliance()` - Use axe-core or pa11y
+- `test_keyboard_navigation()` - Tab order, focus management
+- `test_aria_labels_present()` - Verify ARIA attributes
+- `test_color_contrast_ratios()` - Automated contrast checking
+
+---
+
+## 📱 Browser Testing
+
+### Issue: Cross-Browser Compatibility
+**Priority**: Low
+**Effort**: Large
+
+**Description**:
+No browser-specific testing.
+
+**Gaps**:
+- HTMX behavior in different browsers
+- Alpine.js compatibility
+- CSS rendering differences
+- JavaScript API availability
+
+**Suggested Tests**:
+- Use Playwright or Selenium for multi-browser testing
+- Test in Chrome, Firefox, Safari, Edge
+- Mobile browser testing (iOS Safari, Chrome Mobile)
+- Verify HTMX polling works cross-browser
+
+---
+
+## 🔄 CI/CD Testing
+
+### Issue: Deployment Validation
+**Priority**: Medium
+**Effort**: Medium
+
+**Description**:
+No tests for deployment process.
+
+**Gaps**:
+- Docker build validation
+- Environment variable checking
+- Service health checks
+- Migration automation
+- Zero-downtime deployment
+
+**Suggested Tests**:
+- `test_docker_build_succeeds()` - Build image in CI
+- `test_all_env_vars_present()` - Validate .env.example complete
+- `test_health_endpoint_responds()` - /health check
+- `test_migrations_run_successfully()` - Auto-migration
+- `test_service_restart_no_downtime()` - Graceful restart
+
+---
+
+## 📊 Monitoring & Observability
+
+### Issue: Logging and Error Tracking
+**Priority**: Low
+**Effort**: Small
+
+**Description**:
+No tests for logging behavior.
+
+**Gaps**:
+- Log level configuration
+- Structured logging format
+- Error tracking integration
+- Log sanitization (no secrets)
+- Performance metrics
+
+**Suggested Tests**:
+- `test_logs_at_correct_level()` - Verify log levels
+- `test_logs_are_structured()` - JSON format
+- `test_no_secrets_in_logs()` - API key filtering
+- `test_error_tracking_captures_exceptions()` - Sentry integration
+- `test_performance_metrics_collected()` - Timing data
+
+---
+
+## 📦 Dependency Testing
+
+### Issue: Dependency Security and Updates
+**Priority**: High
+**Effort**: Small
+
+**Description**:
+Need automated dependency checks.
+
+**Current**: Dependabot shows 4 high-severity vulnerabilities
+**Gap**: No automated testing for vulnerabilities
+
+**Suggested Tests**:
+- Add `safety` to CI: `safety check`
+- Add `pip-audit` for vulnerability scanning
+- Test with latest dependency versions in CI
+- Verify all dependencies in requirements match uv.lock
+
+---
+
+## 🧪 Test Infrastructure Improvements
+
+### Issue: Test Data Fixtures
+**Priority**: Low
+**Effort**: Medium
+
+**Description**:
+Need more comprehensive test fixtures.
+
+**Gaps**:
+- Larger variety of SWOT analysis examples
+- Edge cases (empty lists, very long text, special characters)
+- Real-world Reddit data samples
+- Multiple entity comparison scenarios
+
+**Suggested Tests**:
+- Create `tests/fixtures/swot_examples.json` with varied data
+- Add edge case fixtures (max length, empty, unicode, etc.)
+- Mock Reddit API responses with real data structure
+
+---
+
+## Summary of Priorities
+
+### Immediate (Create GH Issues Now):
+1. ✅ E2E Test for Complete Analysis Flow
+2. ✅ AI Agent Testing
+3. ✅ Input Validation and Sanitization
+4. ✅ PDF Cache Memory Limits
+5. ✅ Dependency Security Scanning
+
+### Short Term (Next Sprint):
+6. Database Operations Testing
+7. HTMX OOB Swap DOM Validation
+8. Load Testing
+9. Deployment Validation
+
+### Long Term (Backlog):
+10. Cross-Browser Compatibility
+11. Accessibility Testing
+12. Frontend Component Testing
+13. Monitoring & Observability
+14. Test Data Fixtures
+
+---
+
+## How to Convert to GitHub Issues
+
+For each section above, create a GitHub issue with:
+
+**Title**: [Test Coverage] {Issue Title}
+**Labels**: `testing`, `enhancement`, priority label (`high`, `medium`, `low`)
+**Assignee**: TBD
+**Milestone**: TBD
+
+**Template**:
+```markdown
+## Description
+{Description from above}
+
+## Current Coverage
+{Current Coverage from above}
+
+## Coverage Gap
+{Gap from above}
+
+## Proposed Tests
+{Suggested Tests from above}
+
+## Acceptance Criteria
+- [ ] Tests implemented
+- [ ] Tests pass in CI
+- [ ] Coverage increased by X%
+- [ ] Documentation updated
+```
+
+---
+
+## Test Coverage Metrics
+
+**Current Estimated Coverage**: ~15%
+- ✅ PDF generation core logic
+- ✅ Basic endpoint routing
+- ❌ AI agents
+- ❌ Celery workers
+- ❌ Database operations
+- ❌ Frontend components
+- ❌ Security validation
+
+**Target Coverage**: 80%
+**Critical Path Coverage Target**: 95%
+
+Run coverage report:
+```bash
+pytest --cov=src --cov-report=html
+# Open htmlcov/index.html
+```