A security page with its controls and its gaps

Before you connect a repository or point a browser at your app, you should be able to see what stops it going wrong. The security page lists it.

• GitHub App. Signed webhooks, installs tied to the workspace that started them, read-only code access with every permission listed, runs started only by repository owners, members and collaborators, no automatic runs on fork pull requests, and limits per pull request.
• The browser. Public addresses only, with each name looked up before the browser connects. Neither runner catches DNS rebinding, where a host gives that lookup one address and the browser another. On Cloudflare Browser Run every redirect, frame and fetch is checked again during the run. On ZeusQA's runner machine page loads, frames and fetches are checked, and the page names what is not: WebSocket and WebRTC connections, redirects of fetches, subresources and form posts, names that fail to resolve, and page loads the guard could not fetch itself. Preview URLs from webhooks get the public-address check too.
• Reports and accounts. Runs are visible to your workspace, and read-only to the ZeusQA operator for support. Screenshot links in comments and emails need a per-run token, and anyone who can read the comment can open them, so on a public repository they are public. Sign-in is rate limited and a verified email is needed before any run.
• What we do not have. No independent audit or certification yet, no single sign-on, no choice of where data lives, no defence against DNS rebinding on either runner, and gaps in the runner machine's browser guard. The page also names every place run data is kept and the services a run goes through: ZeusQA's runner machine through a Cloudflare Tunnel or Cloudflare Browser Run for the browser, LLM Gateway for the model you picked and Jev's, Resend for run emails and PostHog for product analytics, with the pages you visit, your clicks and, once you sign in, your name, email, workspace and plan.

A test checks every control on the page against the code and fails if one is renamed or removed.