Security

Last updated 14 October 2026 · ShipFast Solutions Pty Ltd

We design TestifyHub so that sensitive test data never needs to leave your machine.

Architecture

• Local execution: tests run on your device using Playwright. Suites, traffic, secrets and reports are stored in your local workspace.
• Minimal server footprint: our servers handle sign-in, licensing and support only.
• Signed licences: desktop entitlements are cryptographically signed; the signing key is never distributed in the app.
• Local API protection: the local API is protected by a per-installation token, and private-network outbound calls can be blocked.
• Script sandboxing: test scripts run in a restricted sandbox, and imports are validated.

Operational practices

• Encrypted connections (HTTPS) for all account traffic.
• HttpOnly, SameSite session cookies and rate-limited sign-in.
• Access to production systems is restricted to authorised personnel.

Certifications

TestifyHub has not yet been independently certified (for example SOC 2 or ISO 27001). We will state it here if that changes.

Report a vulnerability

Email admin@testifyhub.cloud with details and steps to reproduce. Please give us reasonable time to fix issues before public disclosure and avoid accessing other users' data. We will acknowledge reports promptly.