Replay QA Security Scan

During project setup you'll be taken through the GitHub authentication flow, where you'll be prompted to install the Replay QA GitHub app and specify which repositories it can monitor. Once the app is added to a repository, it listens for changes like pushes to main or new pull requests. You configure which events trigger a new test run.

Yes. Each project can target dev, staging, production, or localhost — switch environments in settings or configure them via the REST API.

Yes. Replay QA can create its own accounts as needed, as long as they're email and password (Google Auth and other OAuth providers won't work). You can also give the agent one or more sets of test account credentials and it will use them, which is great for testing role-specific areas of an app.

This is a tricky one. If you're able to disable bot detection while Replay QA tests your app, that's the recommendation. Otherwise we won't be able to pass that Turing test.

Yes. We run a reverse proxy so Replay QA can reach a web app on your machine. Paste your localhost URL during project setup and we'll walk you through the rest.

The webhook sends a callback URL with every report. POST to it when the fix ships and Replay QA marks the bug resolved, then re-enables that user journey for future runs so you find out immediately if it regresses.

Yes. The Security Scan pass covers the full scope you'd expect from a penetration test: injection vulnerabilities, broken access control, weak authentication, and insecure API behavior. It also reasons about how the app is supposed to work, which lets it surface business logic gaps like IDOR and cross-tenant data exposure — things a generic scanner misses.

Yes. In your project settings you can configure daily or weekly runs on a fixed schedule. Teams often set an overnight run so they wake up to a fresh batch of issues, ready for coding agents or a software factory to work through.

The REST API lets you trigger test runs, switch environments, and retrieve results programmatically. Useful for software factories, CI pipelines, or any workflow where you want Replay QA to run without touching the dashboard.

Pricing is based on how many analyses you run each month, not per seat. There's a free tier to try it on a real repo before you decide. See the pricing page for current plans.