Security

LCTester drives a browser against your site with your test credentials, so we treat isolation and secrets seriously.

Tenant isolation

Every team’s data is separated by Postgres row-level security, enforced in the database itself and not only in application code.

Isolated runs

Each run happens in its own isolated container. Traffic leaves through an egress proxy that blocks private networks and cloud metadata addresses, so a run cannot be used to reach internal systems.

Saved logins

Test account credentials are sealed with public-key encryption when you save them. Only the run service can open them, and they are released only to your site’s own origin.

AI model access

Model calls go through our gateway, which applies spend limits so a runaway test cannot generate unbounded cost.

Web application

The app uses a strict content security policy, so text captured from a site under test cannot run as code in the dashboard. Webhooks and signed CI requests use HMAC signatures with timestamps.

Deleting data

Deleting a project, a team or an account removes the stored files (recordings, screenshots and uploads) as well as the database records.

Responsible disclosure

Found a vulnerability? Email security@[your-domain] with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and do not access other customers’ data.