🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
→

Run #335 — DEMO-022

passed
📄 Download report

queued 2026-09-24 20:40:21 · started 20:40:25 · finished 20:40:32 · duration 7s · target v1.0.0 · chromium · trigger: cli-adopted · batch: 3 tests (terminal)

Activity replay 5 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.61s goto http://127.0.0.1:8000/demo/freight/ 168 ms
+0.61s ⏱ scan: home page 936 ms
+0.79s wait_for_load_state networkidle 445 ms
+1.22s evaluate () => typeof window.axe === 'object' 8 ms
+1.24s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 160 ms
+1.40s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 153 ms
+1.55s ⏱ scan: tracking 1.11 s
+1.55s goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001 236 ms
+1.79s wait_for_load_state networkidle 482 ms
+2.27s evaluate () => typeof window.axe === 'object' 38 ms
+2.31s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 143 ms
+2.45s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 211 ms
+2.66s goto http://127.0.0.1:8000/demo/freight/quote/?restart=1 73 ms
+2.66s ⏱ scan: quote, step 1 827 ms
+2.74s wait_for_load_state networkidle 482 ms
+3.21s evaluate () => typeof window.axe === 'object' 8 ms
+3.23s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 124 ms
+3.35s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 139 ms
+3.49s goto http://127.0.0.1:8000/demo/freight/login/ 81 ms
+3.49s ⏱ scan: staff sign-in 928 ms
+3.57s wait_for_load_state networkidle 483 ms
+4.06s evaluate () => typeof window.axe === 'object' 13 ms
+4.06s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 216 ms
+4.29s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 134 ms
+4.42s goto http://127.0.0.1:8000/demo/freight/login/ 51 ms
+4.47s fill #username 93 ms
+4.56s fill #password 66 ms
+4.62s click #login-btn 277 ms
+4.91s wait_for_selector #signed-in-user 182 ms
+5.09s ⏱ scan: staff dashboard 951 ms
+5.09s goto http://127.0.0.1:8000/demo/freight/ops/ 260 ms
+5.35s wait_for_load_state networkidle 458 ms
+5.80s evaluate () => typeof window.axe === 'object' 7 ms
+5.81s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 100 ms
+5.92s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 125 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

No screenshots (use ctx.screenshot("name") in the test).

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Saved by the test a11y-report.html
a11y-report.json
Folderresults/DEMO-022/20260924-204025-r335/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-022 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.61s] starting DEMO-022
[timing] goto http://127.0.0.1:8000/demo/freight/: 168ms
[timing] wait_for_load_state networkidle: 445ms
[timing] evaluate () => typeof window.axe === 'object': 8ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 160ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 153ms
[test] [   1.55s] accessibility, home page: no violations
[timing] scan: home page: 936ms
[timing] goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001: 236ms
[timing] wait_for_load_state networkidle: 482ms
[timing] evaluate () => typeof window.axe === 'object': 38ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 143ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 211ms
[test] [   2.66s] accessibility, tracking: no violations
[timing] scan: tracking: 1112ms
[timing] goto http://127.0.0.1:8000/demo/freight/quote/?restart=1: 73ms
[timing] wait_for_load_state networkidle: 482ms
[timing] evaluate () => typeof window.axe === 'object': 8ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 124ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 139ms
[test] [   3.49s] accessibility, quote, step 1: no violations
[timing] scan: quote, step 1: 827ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 81ms
[timing] wait_for_load_state networkidle: 483ms
[timing] evaluate () => typeof window.axe === 'object': 13ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 216ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 134ms
[test] [   4.42s] accessibility, staff sign-in: no violations
[timing] scan: staff sign-in: 928ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 51ms
[timing] fill #username: 93ms
[timing] fill #password: 66ms
[timing] click #login-btn: 277ms
[timing] wait_for_selector #signed-in-user: 182ms
[test] [   5.09s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/: 260ms
[timing] wait_for_load_state networkidle: 458ms
[timing] evaluate () => typeof window.axe === 'object': 7ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 100ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 125ms
[test] [   6.04s] accessibility, staff dashboard: no violations
[timing] scan: staff dashboard: 951ms
[test] [   6.04s] report saved: a11y-report.html
[test] [   6.04s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] saved video.webm
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.