KB
Admin

Integrations & settings

Nothing below is connected yet. Status labels reflect what is real today.

Integrations

CI/CD, scheduling, notifications

GitHub
Not connected

Trigger runs on PRs, post status checks

Jenkins
Not connected

Run suites from pipelines via API token

Scheduled runs
Planned

Nightly / cron-based regression

Email notifications
Planned

Run summaries and defect assignments

Slack / Teams
Planned

Failure alerts to channels

Jira
Planned

Two-way defect sync

Platform status

Current connection status

  • Data persistence
    Session only
    Saved cases, approvals and runs live in the open tab and reset on reload. No database records are written.
  • Authentication
    Not enabled
    Demo user only. Next: email + Google sign-in.
  • Roles & permissions
    Not enforced
    Planned roles: Owner, Admin, QA Lead, Tester, Viewer.
  • Execution worker
    Not verified
    Deploy runner/ to Render, then configure PLAYWRIGHT_RUNNER_URL, PLAYWRIGHT_RUNNER_TOKEN and QA_ALLOWED_TARGET_ORIGINS. Live status is shown on Automation.
  • AI provider
    Gemini (server-side key)
    GEMINI_API_KEY is read only on the server. Output is unverified draft suggestions; no canned AI fallback. Without sign-in, generation is rate-limited but publicly callable.

Execution safety guardrails

Requirements for the future Playwright worker

  • ▸Block localhost, loopback, private, link-local, CGNAT and cloud-metadata ranges
  • ▸Resolve DNS server-side and re-check every resolved IP (anti DNS-rebinding)
  • ▸Re-validate every redirect hop against the same rules
  • ▸One isolated, ephemeral container per run; no shared browser state
  • ▸Hard CPU, memory, wall-clock and egress limits per run
  • ▸Credentials stored encrypted; injected at runtime, never logged
  • ▸Only test domains the workspace has verified ownership/authorization for
  • ▸Signed, audited job dispatch from the app to the worker
Gemini free-tier availability, quotas and terms can change. Do not send confidential prospect data without reviewing Google’s data-use terms. Execution stays unavailable until the runner is deployed and verified; nothing is saved beyond the open session.