🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
← →

Run #338 — DEMO-022

passed
📄 Download report

queued 2026-09-24 20:40:35 · started 20:40:39 · finished 20:40:46 · duration 6s · target v1.1.0 · chromium · trigger: cli-adopted · batch: 3 tests (terminal)

Activity replay 4 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.60s ⏱ scan: home page 929 ms
+0.60s goto http://127.0.0.1:8000/demo/freight/ 168 ms
+0.77s wait_for_load_state networkidle 441 ms
+1.21s evaluate () => typeof window.axe === 'object' 8 ms
+1.22s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 160 ms
+1.38s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 151 ms
+1.53s goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001 82 ms
+1.53s ⏱ scan: tracking 769 ms
+1.61s wait_for_load_state networkidle 489 ms
+2.10s evaluate () => typeof window.axe === 'object' 6 ms
+2.11s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 99 ms
+2.21s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 92 ms
+2.30s ⏱ scan: quote, step 1 699 ms
+2.30s goto http://127.0.0.1:8000/demo/freight/quote/?restart=1 37 ms
+2.34s wait_for_load_state networkidle 491 ms
+2.83s evaluate () => typeof window.axe === 'object' 5 ms
+2.83s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 96 ms
+2.93s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 69 ms
+3.00s ⏱ scan: staff sign-in 724 ms
+3.00s goto http://127.0.0.1:8000/demo/freight/login/ 28 ms
+3.02s wait_for_load_state networkidle 495 ms
+3.52s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 126 ms
+3.52s evaluate () => typeof window.axe === 'object' 5 ms
+3.65s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 69 ms
+3.72s goto http://127.0.0.1:8000/demo/freight/login/ 30 ms
+3.75s fill #username 51 ms
+3.80s fill #password 37 ms
+3.84s click #login-btn 134 ms
+3.97s wait_for_selector #signed-in-user 128 ms
+4.10s goto http://127.0.0.1:8000/demo/freight/ops/ 156 ms
+4.11s ⏱ scan: staff dashboard 994 ms
+4.26s wait_for_load_state networkidle 433 ms
+4.70s evaluate () => typeof window.axe === 'object' 34 ms
+4.72s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 136 ms
+4.87s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 235 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

No screenshots (use ctx.screenshot("name") in the test).

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Saved by the test a11y-report.html
a11y-report.json
Folderresults/DEMO-022/20260924-204039-r338/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-022 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.60s] starting DEMO-022
[timing] goto http://127.0.0.1:8000/demo/freight/: 168ms
[timing] wait_for_load_state networkidle: 441ms
[timing] evaluate () => typeof window.axe === 'object': 8ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 160ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 151ms
[test] [   1.53s] accessibility, home page: no violations
[timing] scan: home page: 929ms
[timing] goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001: 82ms
[timing] wait_for_load_state networkidle: 489ms
[timing] evaluate () => typeof window.axe === 'object': 6ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 99ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 92ms
[test] [   2.30s] accessibility, tracking: no violations
[timing] scan: tracking: 769ms
[timing] goto http://127.0.0.1:8000/demo/freight/quote/?restart=1: 37ms
[timing] wait_for_load_state networkidle: 491ms
[timing] evaluate () => typeof window.axe === 'object': 5ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 96ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 69ms
[test] [   3.00s] accessibility, quote, step 1: no violations
[timing] scan: quote, step 1: 699ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 28ms
[timing] wait_for_load_state networkidle: 495ms
[timing] evaluate () => typeof window.axe === 'object': 5ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 126ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 69ms
[test] [   3.72s] accessibility, staff sign-in: no violations
[timing] scan: staff sign-in: 724ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 29ms
[timing] fill #username: 51ms
[timing] fill #password: 37ms
[timing] click #login-btn: 134ms
[timing] wait_for_selector #signed-in-user: 128ms
[test] [   4.10s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/: 156ms
[timing] wait_for_load_state networkidle: 433ms
[timing] evaluate () => typeof window.axe === 'object': 34ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 136ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 235ms
[test] [   5.10s] accessibility, staff dashboard: no violations
[timing] scan: staff dashboard: 994ms
[test] [   5.10s] report saved: a11y-report.html
[test] [   5.10s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] saved video.webm
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.