🧪 Test Hub
testing: Demo target v3.0.0 · built-in demo site
← →

Run #395 — DEMO-013

passed
📄 Download report

queued 2026-09-24 23:24:12 · started 23:24:15 · finished 23:24:18 · duration 3s · target v3.0.0 · chromium · trigger: group · batch: group: Freight smoke

Activity replay 4 frames, captured only while the page was actually changing — idle waits are skipped automatically

activity frame
+0.00s

Step timings follows the replay — click a step to see it there

atsteptook
+0.72s goto http://127.0.0.1:8000/demo/freight/login/ 196 ms
+0.92s fill #username 97 ms
+1.01s fill #password 37 ms
+1.06s click #login-btn 174 ms
+1.23s wait_for_selector #signed-in-user 118 ms
+1.34s ⏱ search shipments 357 ms
+1.34s goto http://127.0.0.1:8000/demo/freight/ops/shipments/ 96 ms
+1.44s fill #shipment-search 50 ms
+1.50s select_option #status-filter 44 ms
+1.54s click #apply-filters 102 ms
+1.64s wait_for_selector #result-count 63 ms
+1.71s inner_text #result-count 10 ms
+1.72s ⏱ sort by ETA 157 ms
+1.73s click #shipments-table th a[data-sort=eta] 104 ms
+1.83s wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta] 54 ms
+1.88s click #shipments-table a:text-is('AF-100001') 101 ms
+1.88s ⏱ open AF-100001 149 ms
+1.98s wait_for_selector #ship-status 48 ms
+2.14s fill #note-text 12 ms
+2.14s ⏱ save a note 101 ms
+2.15s click #note-save 65 ms
+2.22s wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]) 24 ms
+2.25s click #deliver-btn 82 ms
+2.25s ⏱ mark delivered 129 ms
+2.33s wait_for_selector #ship-status:text-is('Delivered') 47 ms

Times are when each step began, on the replay's clock. Add your own phases with with ctx.timed("label"):.

Screenshots

01-shipment.png
01-shipment.png
02-delivered.png
02-delivered.png

Artifacts

Run logrun.log
Playwright trace trace.zip open with: playwright show-trace trace.zip
Result JSONresult.json
Folderresults/DEMO-013/20260924-232415-r395/

Full log

Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).

[harness] test=DEMO-013 browser=chromium headed=False timeout=120s
[harness] target: http://127.0.0.1:8000/demo/
[test] [   0.72s] starting DEMO-013
[timing] goto http://127.0.0.1:8000/demo/freight/login/: 196ms
[timing] fill #username: 97ms
[timing] fill #password: 37ms
[timing] click #login-btn: 174ms
[timing] wait_for_selector #signed-in-user: 118ms
[test] [   1.35s] signed in as tester
[timing] goto http://127.0.0.1:8000/demo/freight/ops/shipments/: 96ms
[timing] fill #shipment-search: 50ms
[timing] select_option #status-filter: 44ms
[timing] click #apply-filters: 102ms
[timing] wait_for_selector #result-count: 63ms
[timing] search shipments: 357ms
[timing] inner_text #result-count: 10ms
[test] [   1.72s] Showing 1–2 of 2 shipments
[timing] click #shipments-table th a[data-sort=eta]: 104ms
[timing] wait_for_selector #shipments-table th[aria-sort] a[data-sort=eta]: 53ms
[timing] sort by ETA: 157ms
[timing] click #shipments-table a:text-is('AF-100001'): 101ms
[timing] wait_for_selector #ship-status: 48ms
[timing] open AF-100001: 149ms
[test] [   2.14s] screenshot: 01-shipment.png
[timing] fill #note-text: 12ms
[timing] click #note-save: 65ms
[timing] wait_for_selector #notes-list .note-text:has-text('promised by Friday'), #note-error:not([hidden]): 24ms
[timing] save a note: 101ms
[timing] click #deliver-btn: 82ms
[timing] wait_for_selector #ship-status:text-is('Delivered'): 47ms
[timing] mark delivered: 129ms
[test] [   2.49s] screenshot: 02-delivered.png
[test] [   2.49s] PASSED
[harness] security: 0 high, 1 medium, 1 low
[harness] saved trace.zip
[harness] result: passed

Security observations what the browser noticed while this ran — not a penetration test

SeverityFindingWhat to do
medium The application is served over plain HTTP
http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit.
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application.
low Response advertises software version (server)
server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for.
Suppress or blank the server header at the proxy.
info Cookie 'csrftoken' is readable by JavaScript (expected)
This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed.
No action. Do check that SESSION cookies are HttpOnly.

All of these appear together on the Security page.