🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
← →

Run #391 — DEMO-013

passed
📄 Download report

queued 2026-09-24 23:23:58 · started 23:24:02 · finished 23:24:05 · duration 3s · target v3.0.0 · chromium · trigger: group · batch: group: Freight smoke

Activity replay 3 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.86s goto http://127.0.0.1:8000/demo/freight/login/ 122 ms
+0.98s fill #username 106 ms
+1.09s fill #password 16 ms
+1.11s click #login-btn 133 ms
+1.24s wait_for_selector #signed-in-user 166 ms
+1.40s ⏱ search shipments 298 ms
+1.41s goto http://127.0.0.1:8000/demo/freight/ops/shipments/ 85 ms
+1.49s fill #shipment-search 38 ms
+1.53s select_option #status-filter 31 ms
+1.56s click #apply-filters 99 ms
+1.66s wait_for_selector #result-count 45 ms
+1.71s click #shipments-table th a[data-sort=eta] 76 ms
+1.71s inner_text #result-count 6 ms
+1.72s ⏱ sort by ETA 121 ms
+1.79s wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta] 45 ms
+1.83s ⏱ open AF-100001 127 ms
+1.84s click #shipments-table a:text-is('AF-100001') 83 ms
+1.92s wait_for_selector #ship-status 43 ms
+2.07s ⏱ save a note 116 ms
+2.08s fill #note-text 21 ms
+2.10s click #note-save 51 ms
+2.15s wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]) 44 ms
+2.21s ⏱ mark delivered 131 ms
+2.21s click #deliver-btn 91 ms
+2.30s wait_for_selector #ship-status:text-is('Delivered') 41 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

01-shipment.png
01-shipment.png
02-delivered.png
02-delivered.png

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Folderresults/DEMO-013/20260924-232402-r391/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-013 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.86s] starting DEMO-013
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 122ms
[timing] fill #username: 106ms
[timing] fill #password: 16ms
[timing] click #login-btn: 133ms
[timing] wait_for_selector #signed-in-user: 166ms
[test] [   1.41s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/shipments/: 85ms
[timing] fill #shipment-search: 38ms
[timing] select_option #status-filter: 31ms
[timing] click #apply-filters: 99ms
[timing] wait_for_selector #result-count: 45ms
[timing] search shipments: 298ms
[timing] inner_text #result-count: 6ms
[test] [   1.72s] Showing 1–2 of 2 shipments
[timing] click #shipments-table th a[data-sort=eta]: 76ms
[timing] wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta]: 45ms
[timing] sort by ETA: 121ms
[timing] click #shipments-table a:text-is('AF-100001'): 83ms
[timing] wait_for_selector #ship-status: 43ms
[timing] open AF-100001: 127ms
[test] [   2.08s] screenshot: 01-shipment.png
[timing] fill #note-text: 21ms
[timing] click #note-save: 51ms
[timing] wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]): 44ms
[timing] save a note: 116ms
[timing] click #deliver-btn: 91ms
[timing] wait_for_selector #ship-status:text-is('Delivered'): 41ms
[timing] mark delivered: 131ms
[test] [   2.44s] screenshot: 02-delivered.png
[test] [   2.44s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.