🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
←

Run #362 — DEMO-022

passed
📄 Download report

queued 2026-09-24 22:05:07 · started 22:05:07 · finished 22:05:13 · duration 6s · target v3.0.0 · chromium · trigger: group · batch: group: Freight extras

Activity replay 4 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.71s goto http://127.0.0.1:8000/demo/freight/ 238 ms
+0.72s ⏱ scan: home page 1.01 s
+0.96s wait_for_load_state networkidle 434 ms
+1.39s evaluate () => typeof window.axe === 'object' 23 ms
+1.41s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 160 ms
+1.58s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 154 ms
+1.73s goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001 74 ms
+1.73s ⏱ scan: tracking 753 ms
+1.80s wait_for_load_state networkidle 482 ms
+2.28s evaluate () => typeof window.axe === 'object' 6 ms
+2.29s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 98 ms
+2.39s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 92 ms
+2.48s ⏱ scan: quote, step 1 692 ms
+2.48s goto http://127.0.0.1:8000/demo/freight/quote/?restart=1 31 ms
+2.52s wait_for_load_state networkidle 495 ms
+3.00s evaluate () => typeof window.axe === 'object' 5 ms
+3.01s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 96 ms
+3.11s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 64 ms
+3.17s goto http://127.0.0.1:8000/demo/freight/login/ 32 ms
+3.17s ⏱ scan: staff sign-in 716 ms
+3.21s wait_for_load_state networkidle 490 ms
+3.69s evaluate () => typeof window.axe === 'object' 5 ms
+3.70s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 117 ms
+3.82s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 71 ms
+3.89s goto http://127.0.0.1:8000/demo/freight/login/ 31 ms
+3.92s fill #username 53 ms
+3.97s fill #password 27 ms
+4.00s click #login-btn 219 ms
+4.22s wait_for_selector #signed-in-user 46 ms
+4.27s ⏱ scan: staff dashboard 791 ms
+4.27s goto http://127.0.0.1:8000/demo/freight/ops/ 110 ms
+4.38s wait_for_load_state networkidle 451 ms
+4.82s evaluate () => typeof window.axe === 'object' 6 ms
+4.83s evaluate /*! axe v4.13.0 * Copyright (c) 2015 - 2026 Deque Systems, Inc. * * Your use 98 ms
+4.93s evaluate async (tags) => { const r = await axe.run(document, {runOnly: {type: 'tag', va 125 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

No screenshots (use ctx.screenshot("name") in the test).

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Saved by the test a11y-report.html
a11y-report.json
Folderresults/DEMO-022/20260924-220507-r362/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-022 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.72s] starting DEMO-022
[timing] goto http://127.0.0.1:8000/demo/freight/: 238ms
[timing] wait_for_load_state networkidle: 434ms
[timing] evaluate () => typeof window.axe === 'object': 23ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 160ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 154ms
[test] [   1.73s] accessibility, home page: no violations
[timing] scan: home page: 1011ms
[timing] goto http://127.0.0.1:8000/demo/freight/track/?id=AF-100001: 74ms
[timing] wait_for_load_state networkidle: 482ms
[timing] evaluate () => typeof window.axe === 'object': 6ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 98ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 92ms
[test] [   2.48s] accessibility, tracking: no violations
[timing] scan: tracking: 753ms
[timing] goto http://127.0.0.1:8000/demo/freight/quote/?restart=1: 31ms
[timing] wait_for_load_state networkidle: 495ms
[timing] evaluate () => typeof window.axe === 'object': 5ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 96ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 65ms
[test] [   3.17s] accessibility, quote, step 1: no violations
[timing] scan: quote, step 1: 692ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 32ms
[timing] wait_for_load_state networkidle: 490ms
[timing] evaluate () => typeof window.axe === 'object': 5ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 117ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 71ms
[test] [   3.89s] accessibility, staff sign-in: no violations
[timing] scan: staff sign-in: 716ms
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 31ms
[timing] fill #username: 53ms
[timing] fill #password: 27ms
[timing] click #login-btn: 219ms
[timing] wait_for_selector #signed-in-user: 46ms
[test] [   4.27s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/: 110ms
[timing] wait_for_load_state networkidle: 451ms
[timing] evaluate () => typeof window.axe === 'object': 6ms
[timing] evaluate /*! axe v4.13.0
 * Copyright (c) 2015 - 2026 Deque Systems, Inc.
 *
 * Your use: 98ms
[timing] evaluate async (tags) => {
  const r = await axe.run(document, {runOnly: {type: 'tag', va: 125ms
[test] [   5.06s] accessibility, staff dashboard: no violations
[timing] scan: staff dashboard: 791ms
[test] [   5.06s] report saved: a11y-report.html
[test] [   5.06s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] saved video.webm
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.