Your site. Your control.
Nothing installed on your side. Nightly checks and checks that sign in or write require proof you control.
No installation
qa.pro runs entirely from our infrastructure. You don't install any software, open any ports or grant system access.
Ownership verification
Nightly checks and checks that sign in or write require proof you control the site, using a file under /.well-known, a meta tag or a DNS record.
Revocable report sharing
Share links are opaque tokens you can revoke at any time. They give access to reports and screenshots only, never logs.
iA first look and first report can read public pages without ownership proof. This lets you try qa.pro quickly. Nightly checks and checks that sign in or write require verification.
How data moves
No inbound port, SSH access or agent. Screenshots stay with reports; page source is not stored.
Controls in place today
These are the key technical and operational controls in qa.pro.
| Passwords | scrypt with a per-user salt. Single-use reset links expire in one hour. |
|---|---|
| Sessions | Signed, HttpOnly, SameSite=Lax cookies. Form posts must originate from qa.pro. |
| API keys | Shown once, stored hashed, team-scoped and revocable. |
| Test accounts | Set by team admins, never shown again. Passwords reach only the browser holding the run, are blanked out of stored logs, never exported and never included in a report. |
| Ownership | Verify with a file under /.well-known, a meta tag or a DNS record. |
| Tenant isolation | Objects are checked against the requesting team. Artifacts use an allowlist of names, not client-supplied paths. |
| Share links | Opaque 32-byte tokens. Revocable. Report and screenshots only, never logs. |
| Front-page reports | Anyone holding the link can read them. Erased after 3 days unless an account keeps them. |
| Transport | HTTPS at the control plane and between browsers and the control plane. |
| Headers | nosniff, frame denial and same-origin referrer policy, including refusal and rate-limit responses. |
| Source | Proprietary software. Source is not disclosed. |
Report a vulnerability
We answer within two business days. Credit is available if you want it. Good-faith research on your own account never leads to legal action.