🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
← →

Run #347 — DEMO-022

passed
📄 Download report

queued 2026-09-24 20:41:19 · started 20:41:23 · finished 20:41:30 · duration 6s · target v3.0.0 · chromium · trigger: cli-adopted · batch: 3 tests (terminal)

Activity replay 5 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.61s goto http://127.0.0.1:8000/demo/freight/ 173 ms
+0.61s ⏱ scan: home page 920 ms
+0.77s wait_for_load_state networkidle 426 ms
+1.20s evaluate () => typeof window.axe === 'object' 9 ms
+1.21s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 159 ms
+1.37s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 151 ms
+1.53s goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001 72 ms
+1.53s ⏱ scan: tracking 801 ms
+1.59s wait_for_load_state networkidle 485 ms
+2.08s evaluate () => typeof window.axe === 'object' 9 ms
+2.09s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 118 ms
+2.21s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 115 ms
+2.33s goto http://127.0.0.1:8000/demo/freight/quote/?restart=1 66 ms
+2.33s ⏱ scan: quote, step 1 872 ms
+2.40s wait_for_load_state networkidle 474 ms
+2.86s evaluate () => typeof window.axe === 'object' 16 ms
+2.88s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 198 ms
+3.08s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 117 ms
+3.19s ⏱ scan: staff sign-in 895 ms
+3.20s goto http://127.0.0.1:8000/demo/freight/login/ 63 ms
+3.27s wait_for_load_state networkidle 475 ms
+3.74s evaluate () => typeof window.axe === 'object' 11 ms
+3.75s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 222 ms
+3.97s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 122 ms
+4.09s goto http://127.0.0.1:8000/demo/freight/login/ 66 ms
+4.16s fill #username 136 ms
+4.29s fill #password 66 ms
+4.36s click #login-btn 292 ms
+4.65s wait_for_selector #signed-in-user 180 ms
+4.83s ⏱ scan: staff dashboard 815 ms
+4.84s goto http://127.0.0.1:8000/demo/freight/ops/ 143 ms
+4.98s wait_for_load_state networkidle 441 ms
+5.41s evaluate () => typeof window.axe === 'object' 6 ms
+5.42s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 100 ms
+5.53s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 124 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

No screenshots (use ctx.screenshot("name") in the test).

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Saved by the test a11y-report.html
a11y-report.json
Folderresults/DEMO-022/20260924-204123-r347/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-022 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.60s] starting DEMO-022
[timing] goto http://127.0.0.1:8000/demo/freight/: 173ms
[timing] wait_for_load_state networkidle: 426ms
[timing] evaluate () => typeof window.axe === 'object': 9ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 159ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 151ms
[test] [   1.53s] accessibility, home page: no violations
[timing] scan: home page: 921ms
[timing] goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001: 72ms
[timing] wait_for_load_state networkidle: 485ms
[timing] evaluate () => typeof window.axe === 'object': 9ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 118ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 115ms
[test] [   2.33s] accessibility, tracking: no violations
[timing] scan: tracking: 801ms
[timing] goto http://127.0.0.1:8000/demo/freight/quote/?restart=1: 66ms
[timing] wait_for_load_state networkidle: 474ms
[timing] evaluate () => typeof window.axe === 'object': 16ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 198ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 117ms
[test] [   3.20s] accessibility, quote, step 1: no violations
[timing] scan: quote, step 1: 872ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 63ms
[timing] wait_for_load_state networkidle: 475ms
[timing] evaluate () => typeof window.axe === 'object': 11ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 222ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 122ms
[test] [   4.09s] accessibility, staff sign-in: no violations
[timing] scan: staff sign-in: 895ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 66ms
[timing] fill #username: 136ms
[timing] fill #password: 66ms
[timing] click #login-btn: 292ms
[timing] wait_for_selector #signed-in-user: 181ms
[test] [   4.83s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/: 143ms
[timing] wait_for_load_state networkidle: 441ms
[timing] evaluate () => typeof window.axe === 'object': 6ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 100ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 124ms
[test] [   5.65s] accessibility, staff dashboard: no violations
[timing] scan: staff dashboard: 815ms
[test] [   5.65s] report saved: a11y-report.html
[test] [   5.65s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] saved video.webm
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.