Your sites are tested only with your proof, from runners you can name.
The architecture is the security model: the control plane holds accounts, schedules and results. Browsers run on runners, ours in a shared pool or yours. Ours never touch a site you have not verified. What follows is what that means in practice.
Runners pull, we never push
A runner registers with the team's enrollment token (shared, rotatable on the Runners page) and then polls for work with its own bearer token, stored hashed (stored hashed). No inbound port on your side, no SSH, no agent with root. Remove a runner and its token dies with it. Our shared runners follow four rules: your own runner takes precedence; only verified, publicly reachable sites; only within your plan's quota; only the run they hold.
Test accounts stay with the site
Credentials for login or checkout tests are stored per site, shown only to team admins, and travel only to the runner holding that run, as the browser's environment: yours, or one of ours for that run alone. Runner logs are scrubbed of known secrets before they leave the runner.
Tenant isolation everywhere
Every object is checked against the team of the session or key that asks for it. Artifacts are served from an allowlist of names, never from a path a client supplies. Share links are opaque tokens you can revoke.
Controls
| Passwords | scrypt with a per-user salt; reset links are single-use and expire in an hour |
| Sessions | signed, HttpOnly, SameSite=Lax cookies; form posts must originate from this site |
| API keys | shown once, stored hashed, revocable; scoped to one team |
| Transport | HTTPS in front of the control plane (a reverse proxy in self-hosted installs); runners talk to it the same way |
| Headers | nosniff, frame denial, same-origin referrer policy on every response, including refusals and rate-limit answers |
| Ownership | hosted runners test a site only after a proof you control: a file at /.well-known, a meta tag, or a DNS TXT record; private hosts are never reached from the pool |
| Self-hosted | the whole control plane can run inside your network with Postgres you own; nothing phones home |
| Source | the engine is Apache 2.0; the control plane's source is available to subscribers and for a 30-day evaluation, so your security team can read it before you commit |
Reporting a vulnerability
Mail security@qa.pro. We answer within two business days, credit reporters who want it, and never take legal action against good-faith research on your own account or a self-hosted install.