queued 2026-09-25 00:27:40 · started 00:27:40 · finished 00:28:57 · duration 1m 17s · target v3.0.0 · chromium · trigger: cli-adopted · batch: 2 tests (terminal)
Activity replay 2 frames, captured only while the page was actually changing — idle waits are skipped automatically
+0.00s
Step timings follows the replay — click a step to see it there
| at | step | took |
|---|---|---|
| +0.76s | goto http://127.0.0.1:8000/demo/ | 123 ms |
| +0.88s | click #reveal-btn | 125 ms |
| +1.00s | evaluate document.title = 'marathon step 1/15' | 6 ms |
| +6.01s | click #reveal-btn | 27 ms |
| +6.04s | evaluate document.title = 'marathon step 2/15' | 3 ms |
| +11.05s | click #reveal-btn | 24 ms |
| +11.08s | evaluate document.title = 'marathon step 3/15' | 4 ms |
| +16.08s | click #reveal-btn | 26 ms |
| +16.11s | evaluate document.title = 'marathon step 4/15' | 5 ms |
| +21.12s | click #reveal-btn | 22 ms |
| +21.14s | evaluate document.title = 'marathon step 5/15' | 3 ms |
| +26.14s | click #reveal-btn | 25 ms |
| +26.18s | evaluate document.title = 'marathon step 6/15' | 3 ms |
| +31.18s | click #reveal-btn | 27 ms |
| +31.21s | evaluate document.title = 'marathon step 7/15' | 3 ms |
| +36.22s | click #reveal-btn | 25 ms |
| +36.24s | evaluate document.title = 'marathon step 8/15' | 3 ms |
| +41.24s | click #reveal-btn | 25 ms |
| +41.28s | evaluate document.title = 'marathon step 9/15' | 4 ms |
| +46.27s | click #reveal-btn | 25 ms |
| +46.31s | evaluate document.title = 'marathon step 10/15' | 3 ms |
| +51.31s | click #reveal-btn | 26 ms |
| +51.34s | evaluate document.title = 'marathon step 11/15' | 3 ms |
| +56.34s | click #reveal-btn | 25 ms |
| +56.37s | evaluate document.title = 'marathon step 12/15' | 3 ms |
| +1:01.38 | click #reveal-btn | 24 ms |
| +1:01.41 | evaluate document.title = 'marathon step 13/15' | 3 ms |
| +1:06.42 | click #reveal-btn | 25 ms |
| +1:06.44 | evaluate document.title = 'marathon step 14/15' | 4 ms |
| +1:11.44 | click #reveal-btn | 24 ms |
| +1:11.47 | evaluate document.title = 'marathon step 15/15' | 3 ms |
Times are when each step began, on the replay's clock. Add your own phases with
with ctx.timed("label"):.
Screenshots
Artifacts
| Run log | run.log |
| Playwright trace | trace.zip
open with: playwright show-trace trace.zip |
| Result JSON | result.json |
| Folder | results/DEMO-100/20260925-002740-r462/ |
Full log
Read from the S3 bucket (the last 20 KB; the whole file is the Run log link above).
[harness] test=DEMO-100 browser=chromium headed=False timeout=180s [harness] target: http://127.0.0.1:8000/demo/ [test] [ 0.76s] starting DEMO-100 [timing] goto http://127.0.0.1:8000/demo/: 123ms [timing] click #reveal-btn: 125ms [timing] evaluate document.title = 'marathon step 1/15': 6ms [test] [ 1.01s] step 1/15 [timing] click #reveal-btn: 27ms [timing] evaluate document.title = 'marathon step 2/15': 3ms [test] [ 6.04s] step 2/15 [timing] click #reveal-btn: 24ms [timing] evaluate document.title = 'marathon step 3/15': 4ms [test] [ 11.08s] step 3/15 [timing] click #reveal-btn: 26ms [timing] evaluate document.title = 'marathon step 4/15': 5ms [test] [ 16.11s] step 4/15 [timing] click #reveal-btn: 22ms [timing] evaluate document.title = 'marathon step 5/15': 3ms [test] [ 21.14s] step 5/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 6/15': 3ms [test] [ 26.18s] step 6/15 [timing] click #reveal-btn: 27ms [timing] evaluate document.title = 'marathon step 7/15': 3ms [test] [ 31.21s] step 7/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 8/15': 3ms [test] [ 36.24s] step 8/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 9/15': 4ms [test] [ 41.28s] step 9/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 10/15': 3ms [test] [ 46.31s] step 10/15 [timing] click #reveal-btn: 26ms [timing] evaluate document.title = 'marathon step 11/15': 3ms [test] [ 51.34s] step 11/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 12/15': 3ms [test] [ 56.37s] step 12/15 [timing] click #reveal-btn: 24ms [timing] evaluate document.title = 'marathon step 13/15': 3ms [test] [ 61.41s] step 13/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 14/15': 3ms [test] [ 66.44s] step 14/15 [timing] click #reveal-btn: 25ms [timing] evaluate document.title = 'marathon step 15/15': 3ms [test] [ 71.47s] step 15/15 [test] [ 76.54s] screenshot: 01-marathon-done.png [test] [ 76.54s] PASSED [harness] security: 0 high, 2 medium, 1 low [harness] saved trace.zip [harness] result: passed
Security observations what the browser noticed while this ran — not a penetration test
| Severity | Finding | What to do |
|---|---|---|
| medium | The application is served over plain HTTP http://127.0.0.1:8000/demo/ is not HTTPS, so anything typed into it travels the network in the clear and can be modified in transit. |
On an isolated lab network this may be a deliberate choice -- if so, note it and move on. Anywhere else, terminate TLS in front of the application. |
| medium | Missing Content-Security-Policy Without it, an injected script can run with the page's full privileges. This is the single most effective header against XSS. |
Set the Content-Security-Policy response header on the application or its reverse proxy. |
| low | Response advertises software version (server) server: pw-testhub -- this tells an attacker exactly what to look up known vulnerabilities for. |
Suppress or blank the server header at the proxy. |
| info | Cookie 'csrftoken' is readable by JavaScript (expected) This looks like a CSRF token, which the page's own JavaScript has to read in order to send it back. HttpOnly would break that. Nothing to do -- listed so you know it was checked and not missed. |
No action. Do check that SESSION cookies are HttpOnly. |
All of these appear together on the Security page.