# Replay QA Replay QA is an agentic web application testing platform with an automated Security Scan for penetration testing. It explores live apps, tests authenticated journeys, captures runtime evidence, and produces reports that teams can use to remediate security and other software defects. - Findings24: - ウェブサイト: - 料金: Freemium - カテゴリー: AIテストアシスタント ## Replay QAとは？ Replay QA is an agentic testing platform for live web applications. Its Security Scan performs an automated penetration-testing pass focused on vulnerabilities that can arise in rapidly built applications, including injection flaws, broken access control, IDOR, cross-tenant data exposure, and weak authentication. The service explores an application, identifies user journeys, and runs tests in a Chromium browser. For security testing, ownership verification is required. Runtime recordings preserve the session evidence needed to investigate a finding, while the resulting reports describe the behavior, impact, reproduction evidence, root cause, and suggested fix. Replay QA can be started from a URL or connected to a GitHub repository. In addition to security issues, the broader testing workflow can identify runtime, UI, accessibility, and performance problems and route results into pull requests or issue trackers. ## Replay QAでできること ### Automated security scanning Runs penetration-style checks against a live web application for injection flaws, broken access control, IDOR, cross-tenant data exposure, weak authentication, and related business-logic gaps. ### Authenticated application testing Tests behavior in a running authenticated application, with ownership verification required before a Security Scan can run. ### Deterministic runtime recordings Captures DOM mutations, network calls, JavaScript frames, and session behavior in the browser so agents can investigate failures from the runtime evidence rather than from source-code assumptions alone. ### Pen-test-style findings Reports explain the vulnerability, discovery path, potential attacker impact, evidence from the tested behavior, severity, root cause, and a suggested remediation. ### Repository and environment workflows Accepts a direct URL or GitHub repository and supports testing against development, staging, production, or localhost environments. ### Automated delivery into team tools Can comment on pull requests and file findings to GitHub Issues, Linear, Jira, or another endpoint that accepts a webhook. ## 利用シーン ### Review AI-generated application code Run a security pass against an application built or changed quickly with AI coding agents, looking for access-control, injection, and data-isolation failures that functional testing may miss. ### Check a pull request before merge Connect a GitHub repository so a run tests the preview deployment and posts the root cause and suggested fix as a pull-request comment next to the relevant change. ### Validate a multi-tenant application Use authenticated testing to check whether one user can access another customer's project or other tenant-scoped data, with evidence preserved in the resulting finding. ### Maintain recurring coverage Configure runs on pushes, pull requests, or a daily or weekly schedule so teams can receive fresh findings as the application changes. ### Test an app without an existing suite Start with a URL rather than a prewritten test suite; Replay QA explores the application, discovers journeys, and generates tests for those flows. ## よくある質問 ### Does Replay QA require an existing test suite? No. The documented workflow starts with a URL or connected repository. Replay QA explores the application, discovers user journeys, and generates tests for those journeys. ### What does a Security Scan report contain? A security finding explains what the vulnerability is, how it was discovered, what an attacker could do with it, and what to fix. The broader reports can also include a recording, annotated screenshots, root-cause analysis, severity, and a suggested fix. ### How does Replay QA verify a security issue? Security Scan tests behavior in a live authenticated application and preserves evidence from the session. Replay QA says its reports are based on observed behavior, including examples such as one authenticated user accessing another customer's project. ### Which environments can be tested? Projects can point to development, staging, production, or localhost. Environments can be switched in settings or managed through the REST API. ### How is Replay QA delivered into an existing workflow? A GitHub connection can trigger runs on pushes to main, pull requests, or a daily or weekly schedule. Results can be posted as pull-request comments or filed through GitHub Issues, Linear, Jira, or a webhook-compatible endpoint. ## クイック情報 - **Product type**: Agentic web application testing and automated penetration testing - **Primary input**: A live web app URL or connected GitHub repository - **Security coverage**: Injection, broken access control, IDOR, cross-tenant data exposure, and weak authentication - **Testing environments**: Development, staging, production, or localhost - **Free plan**: 25 credits per month; no credit card required - **Security and privacy**: Replay reports SOC 2 Type 2 monitoring, encryption in transit and at rest, and Google SAML 2.0 single sign-on