Security checks in every run

A run already loads your pages, scripts and API calls. Now ZeusQA reads those responses for security weaknesses too, without sending a single extra request.

• Security headers. A missing Content-Security-Policy, a policy that still lets inline or any-origin scripts run, pages any site can frame, no HSTS on HTTPS, no X-Content-Type-Options: nosniff, and a Referrer-Policy that leaks full URLs.
• Cookies. Session cookies without HttpOnly, cookies set over HTTPS without Secure, SameSite=None without Secure, and cookies without SameSite. Values are never stored, only names and attributes.
• Mixed content. Your own HTTPS pages that load scripts, styles, data or images over plain HTTP.
• Open redirects. A redirect to another site named in the URL's own query string.
• Leaked secrets and stack traces. Private keys, live Stripe, GitHub, AWS, Slack, OpenAI and Anthropic keys in first-party responses, shown redacted, and Python, Node, Java, PHP, Ruby, ASP.NET and Django debug output.
• Source maps. Maps that were served, and production scripts that point to them.

Each finding comes with a severity, the URL and header or line it was seen in, and the fix. On the run page they sit in their own Security block, and the pull request comment gets a Security section under the findings, with a line that says how many responses and pages were checked. They are counted apart from QA findings everywhere a count appears: a security tag on the run in the runs list, a security count under Findings on Overview and Trends, a Security column in the Trends CSV, and a Security section in run emails and digests. On a project's Flows page they never count as findings on a flow. Those counts also include security issues the agent files itself, such as another user's data on screen. The verdict stays the QA verdict: security findings do not turn a pass into a fail.

The checks are passive. They only look at traffic your test already caused, judge only your own site (on shared hosts such as vercel.app or pages.dev that means your own subdomain), stay inside the same URL safety rules as the browser, and send no attack payloads.