🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
← →

Run #383 — DEMO-013

passed
📄 Download report

queued 2026-09-24 23:10:27 · started 23:10:30 · finished 23:10:33 · duration 2s · target v3.0.0 · chromium · trigger: group · batch: group: Freight smoke

Activity replay 3 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.81s goto http://127.0.0.1:8000/demo/freight/login/ 150 ms
+0.96s fill #username 72 ms
+1.03s fill #password 14 ms
+1.04s click #login-btn 162 ms
+1.20s wait_for_selector #signed-in-user 137 ms
+1.34s ⏱ search shipments 269 ms
+1.34s goto http://127.0.0.1:8000/demo/freight/ops/shipments/ 84 ms
+1.43s fill #shipment-search 30 ms
+1.45s select_option #status-filter 17 ms
+1.47s click #apply-filters 98 ms
+1.57s wait_for_selector #result-count 40 ms
+1.62s inner_text #result-count 6 ms
+1.63s ⏱ sort by ETA 134 ms
+1.63s click #shipments-table th a[data-sort=eta] 83 ms
+1.71s wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta] 51 ms
+1.76s click #shipments-table a:text-is('AF-100001') 91 ms
+1.76s ⏱ open AF-100001 138 ms
+1.85s wait_for_selector #ship-status 46 ms
+2.00s fill #note-text 13 ms
+2.00s ⏱ save a note 89 ms
+2.01s click #note-save 56 ms
+2.07s wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]) 20 ms
+2.10s ⏱ mark delivered 142 ms
+2.10s click #deliver-btn 89 ms
+2.19s wait_for_selector #ship-status:text-is('Delivered') 53 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

01-shipment.png
01-shipment.png
02-delivered.png
02-delivered.png

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Folderresults/DEMO-013/20260924-231030-r383/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-013 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.80s] starting DEMO-013
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 150ms
[timing] fill #username: 72ms
[timing] fill #password: 14ms
[timing] click #login-btn: 162ms
[timing] wait_for_selector #signed-in-user: 137ms
[test] [   1.34s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/shipments/: 84ms
[timing] fill #shipment-search: 30ms
[timing] select_option #status-filter: 17ms
[timing] click #apply-filters: 98ms
[timing] wait_for_selector #result-count: 40ms
[timing] search shipments: 269ms
[timing] inner_text #result-count: 6ms
[test] [   1.63s] Showing 1–2 of 2 shipments
[timing] click #shipments-table th a[data-sort=eta]: 83ms
[timing] wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta]: 51ms
[timing] sort by ETA: 134ms
[timing] click #shipments-table a:text-is('AF-100001'): 91ms
[timing] wait_for_selector #ship-status: 46ms
[timing] open AF-100001: 138ms
[test] [   2.00s] screenshot: 01-shipment.png
[timing] fill #note-text: 13ms
[timing] click #note-save: 56ms
[timing] wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]): 20ms
[timing] save a note: 89ms
[timing] click #deliver-btn: 89ms
[timing] wait_for_selector #ship-status:text-is('Delivered'): 53ms
[timing] mark delivered: 142ms
[test] [   2.34s] screenshot: 02-delivered.png
[test] [   2.34s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.