The security controls, and the gaps, on one page

Each control on the page names the file and symbol that enforce it. A test checks every one against the code and fails if one is renamed or removed, so the page cannot drift from what ships.

• No independent audit or certification yet. If your vendor review needs a third-party report, ZeusQA cannot give you one today.
• The agent is a model, and text on the page it tests can mislead it. A pull request description reaches it marked as data, and the runner tells it page text is data too, but Cloudflare Browser Run does not, and neither stops a determined page.
• There is no choice of region for run data. The web app keeps runs in Cloudflare D1 and KV and screenshots in Cloudflare R2 for 30 days, a Cloudflare Browser Run replay stays in that run's Durable Object storage for 30 days, and a run on ZeusQA's runner keeps its files and video on its own Cloudflare Container's disk, which is erased when the container stops, minutes after the run.
• A run goes through other companies. Its browser runs in a Cloudflare Container with ZeusQA's runner, or on Cloudflare Browser Run when no container is free. Screenshots, page text and your test instructions go through LLM Gateway to the provider of the model you picked, and to Jev's model when Jev is on. On Pro and Team, for each repository with security review turned on, the diff of every new commit goes through LLM Gateway to Anthropic for the review. Run emails, with the summary, findings and last screenshot, are sent through Resend, and the web app sends PostHog product analytics: the pages you visit with their full address, your clicks with the clicked element's text, run reports included, and once you sign in your name, email, user id, workspace and plan.
• The browser guard in ZeusQA's runner has holes. WebSocket and WebRTC connections are not checked there, redirects of fetches, subresources and form posts are not checked, a hostname that fails to resolve is let through, and when the guard cannot fetch a page load itself, the browser loads it and follows its redirects unchecked. Cloudflare Browser Run closes these: it removes WebSocket and WebRTC from the page, checks every redirect, and refuses a failed lookup.
• DNS rebinding is not caught on either runner. The address check and the browser look the hostname up separately, and a verdict is reused for up to a minute, so a host that answers the check with a public address and the browser with 127.0.0.1 or a cloud metadata address such as 169.254.169.254 gets through.
• No single sign-on. Accounts sign in with an email address and a password of at least 10 characters.
• ZeusQA's own pages send no security headers yet: no Content-Security-Policy, nothing that stops another site from framing them (no frame-ancestors or X-Frame-Options), no Strict-Transport-Security, no X-Content-Type-Options: nosniff and no Referrer-Policy.