Security and privacy

What leaves your machine, what is stored, and how secrets are handled.

What leaves your machine

Per step, the CLI sends the TestedOK API the app's accessibility tree for the current screen (control roles, labels, values and positions, and visible text), your flow, and what happened so far. That is what the decision model reads. For each distinct screen it also uploads a JPEG at screen-point resolution and the tree, which is what the run page shows. When a step is escalated, a screenshot goes to the vision model for that step.

A project can turn screenshots off in Settings; its runs then send steps and timings, no pictures and no trees.

Secrets

A secret's value is typed into the app by the CLI and goes nowhere else: the model receives the placeholder, screens and trees are masked before they leave, log lines are masked, and a screen that shows a secret gets no picture. Values live in your Keychain, in CI variables, or encrypted in the project's store. See secrets.

Shared secrets and account passwords are AES-256-GCM under a key per project, wrapped by a master key held only as a secret on the API. They are write-only for people; the dashboard can set them but cannot read them, and the only reader is a signed-in CLI about to type one.

The CLI and drivers

The CLI is a signed binary, distributed with a checksum. The iOS driver is an XCUITest runner on the simulator; the Android driver is an instrumentation APK that listens on the device's loopback only. Decisions are not made in the binary: it contains no model prompts or keys.

Accounts and access

Sign in with Google or email and password (a confirmed address is needed to mint API tokens). API tokens are hashed at rest; the token itself is shown once. Project members are invited by email; owners and admins manage secrets and accounts. The dashboard authenticates each request against the API with a read-only credential that is refused on every write and on secrets.

Sign-in attempts are rate limited. Sockets authenticate by header, never by URL.

Where things run

The API and dashboard run on Cloudflare Workers; data is in Postgres (Neon) and screenshots in R2 (Cloudflare). Analytics is PostHog, first-party proxied, with consent, and page views never carry tokens or codes. Errors are reported with the run they belong to and nothing else.

What we do not do

We never see your app's source, your device, or a screen you have turned pictures off for. We do not train models on your runs.

Questions or a report: hello@testedok.dev.