Open source MIT licensed · Built on Playwright

Browser tests that can’t break real things.

AirlockQA clicks through your website like a real customer to check that everything works. Each test runs behind a safety door, so it can’t refund a card, delete data or leak a real password — and every run ends with a signed receipt anyone can check.

Record a browser session, compile it to Playwright TypeScript, and run it locally or from CI. Requests pass a policy gateway with host, path and method rules and phantom-token swaps, and every run emits a hash-linked, signed evidence bundle.

Explain it for

Explore the demo

npm i -D airlockqa

Free on your laptop or in CI
Works with GitHub Actions
A signed receipt for every run

Watch one test run

Allowed Stopped

shop.test/checkout Your testPlaywright context

Order summary

1 × Trail runner · $49.00

Pay $49

Airlock safety doorPolicy gateway

Look up saved cardGET /v1/payment_methods stand-in keyph_sec_stripe… real key addedsk_live_•••• swapped

Refund $49POST /v1/refundsStopped403 BLOCKED

Place orderPOST /api/orders test loginphantom session checkedallowed host

Paymentsapi.stripe.com

api.stripe.comallowedHosts

Refunds/v1/refunds

never reachedblockedPaths

Ordersstaging.shop.test

staging.shop.testallowedEgressHosts

Allowed — the door swapped in the real keyALLOWED · phantom → real on an allowed host Stopped — tests may never issue refundsBLOCKED · rule block-destructive-refunds Allowed — order placed in the test shopALLOWED · host in allowedEgressHosts

Run receiptevidence ledgerrun_40549cd06baf

Card looked up with a stand-in keySECRET_SWAP GET /v1/payment_methods 200

Refund stopped at the doorEGRESS_BLOCKED POST /v1/refunds 403

Test order placedACTION_COMPLETE POST /api/orders 201

Receipt sealed — anyone can check itsealed · merkle e2114ac9…6aece · HMAC-SHA256

Built on tools engineers already trust

Playwright
TypeScript
Bun or Node.js 18+
GitHub Actions
MIT licensed

How it works

From a few clicks to a signed result.

No test scripts to write by hand. Show AirlockQA what a customer does once — it turns that into a test, runs it safely and hands you proof.

explore → compile → test → audit. Each stage is one CLI command and produces a file you can commit and review.

Record

Click through your site once. AirlockQA watches and writes down every step.

airlock explore <url> records DOM actions and network events to a trace file.
Turn it into a test

Your clicks become a real, repeatable test that people and machines can both read.

airlock compile emits Playwright TypeScript with multi-attribute fallback locators.
Run it safely

Run it on your laptop or on every code change. The safety door checks every request.

airlock test --local | --cloud runs behind the request policy; cloud runs go to POST /v1/runs.
Get a receipt

Every run ends with a signed receipt showing exactly what happened — and it breaks if anyone edits it.

airlock audit recomputes the Merkle root and checks the HMAC-SHA256 signature.

What’s inside

Everything a careful test needs, in one toolkit.

Reading as

Request policy · Phantom credentials

A safety door for every request.

Your test talks to payment providers, email services and your own APIs. AirlockQA checks each request on the way out: safe ones go through; risky ones — refunds, deletes, unknown websites — are stopped. Tests only carry a stand-in key; the real one is added at the door, and only for places you approve.

Refunds, deletes and unknown sites are blocked by default
Stand-in keys instead of real passwords in the browser
A clear log of every allow and every block

The gateway intercepts requests in the Playwright context and evaluates host, path and method rules under a default-deny action. Phantom tokens are swapped for configured real values only on allowedHosts, and matching upstream responses are sanitized before they reach the page.

defaultAction: "BLOCK" with allow and deny host lists
Per-secret allowed hosts, methods and blocked paths
Verdicts logged as ALLOWED, BLOCKED or SANITIZED

Covers requests made by the test browser — it isn’t an OS-level firewall.

Self-healing locators

When your design changes, tests find their way.

Renamed a button or moved it? That’s where most tests break. AirlockQA looks for the same element by its label, text and place on the page, fixes the step, and shows you exactly what it changed so a person can approve it.

When a selector misses, the healer scores candidates by test id, accessible name, text and structure. Above the confidence threshold (0.8 by default) it resolves the locator and writes the before/after DOM to a mutation dataset you can inspect with airlock dataset.

Every repair is a suggestion you can accept or reject in the console.

Browser checkpoints · Forks

Save points: log in once, test many paths.

Like a save point in a game. AirlockQA remembers a moment — signed in, cart filled — and starts new tests from there, side by side, instead of repeating the same steps every time.

A checkpoint captures storage state, session storage, URL and a DOM hash, then restores them into fresh Playwright contexts. airlock fork cart_ready --workers 5 runs variations in parallel from the same warm state.

Browser state only — not VM or process memory.

Execution evidence

A receipt you can check, for every run.

Each run writes down what happened, step by step, and seals it. If anyone changes a line later, the seal breaks. Share it with a teammate, a client or an auditor as proof of what was tested.

Every event becomes a hash-linked ledger block; the run’s Merkle root is signed with HMAC-SHA256 or Ed25519. airlock audit and the console verifier recompute the chain and flag tampering.

Evidence, not a compliance certification.

The lab

Power tools, clearly labelled.

These work today inside the test browser. Each one is marked Preview and says exactly what it covers.

Browser-level prototypes with explicit scope. Limits for each are listed in the capability table below.

Time warp

PREVIEW

See what your app shows 14 days from now — trials ending, coupons expiring — without waiting two weeks.

Offsets Date in the page and later navigations. Server, database and cron clocks don’t move.

airlock warp "+14 days"

Fixtures

PREVIEW

Save an outside service’s answer once and replay it, so a test doesn’t fail when that service has a bad day.

Serves saved responses for matching browser-context requests. Misses currently pass through to the network.

browser-context routes

Chaos report

PREVIEW

Spots checkout buttons that could charge a customer twice if they double-click.

Observes a mutation request and reports whether an idempotency key was sent. Duplicate, abort and 502 scenarios are simulated.

airlock chaos <url>

Failure X-Ray

PREVIEW

When a test fails, see which request broke and what the server said back.

Adds W3C traceparent headers and records response metadata; backend detail only when the server returns it.

in every run report

Bug capsules

PREVIEW

Turn a captured bug into a test that reproduces it, with obvious personal details scrubbed out.

Replays a sanitized event capsule and synthesizes a Playwright repro spec. Redaction is heuristic — no real user data yet.

airlock teleport capsule.json

Who it’s for

Clear enough for the whole team.

Founders & product

Know what’s tested — in plain words.

Readable steps and run summaries
Receipts to share with customers
No code needed to follow along

QA & testers

Record tests by clicking.

The recorder writes the test for you
Self-healing cuts broken-selector churn
Save points for long flows

Developers

It’s just Playwright.

TypeScript specs you own and commit
A CLI for local runs and CI
One JSON file of configuration

Security & compliance

Proof, not promises.

Default-deny request policy
Real keys stay out of the browser
Hash-linked, verifiable evidence

For engineers

Five commands from zero to signed evidence.

# install and set up
$ npm install --save-dev airlockqa
$ npx airlock init
# record a session, then compile it
$ npx airlock explore http://localhost:3000 --name checkout-flow
$ npx airlock compile .airlock/traces/checkout-flow-trace.json -o tests/checkout.spec.ts
# run behind the policy, then verify the evidence
$ npx airlock test --local
$ npx airlock audit .airlock/compliance/latest-attestation.json
✓ VALID_CHAIN · merkle root e2114ac9…6aece · HMAC-SHA256

{
  "projectName": "Acme SaaS QA",
  "baseUrl": "http://localhost:3000",
  "secrets": {
    "STRIPE_KEY": {
      "phantom": "ph_sec_stripe_test_placeholder",
      "allowedHosts": ["api.stripe.com"],
      "allowedMethods": ["GET", "POST"],
      "blockedPaths": ["*/refunds*", "*/transfers*"]
    }
  },
  "policy": {
    "defaultAction": "BLOCK",
    "allowedEgressHosts": ["localhost", "api.stripe.com"],
    "blockedEgressHosts": ["pastebin.com", "webhook.site"]
  },
  "healer": { "autoHeal": true, "confidenceThreshold": 0.8 }
}

name: AirlockQA
on: [push, pull_request]
jobs:
  browser-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - run: bun install && bunx playwright install --with-deps chromium
      - run: bunx airlock test --cloud
        env:
          AIRLOCK_API_KEY: ${{ secrets.AIRLOCK_API_KEY }}
      - run: bunx airlock audit

Real secret values live only in your runner — the browser and cloud payloads only ever see the phantom.

Local

Your laptop or CI runner. Free, no key.

--local

Cloud plan

Hosted runs from CI. The key travels only as an HTTPS Bearer token.

--cloud

Enterprise

Point the same CLI at your own endpoint.

AIRLOCK_CLOUD_URL

A console on your machine

Browse runs, checkpoints, healing logs and evidence locally.

npx airlock serve -p 4100

Straight answers

What AirlockQA does today — and what it doesn’t yet.

Testing tools love big claims. We describe each capability by what it actually does, so you know exactly what you’re relying on.

Capability	Does today	Not yet
Safety door	Checks requests the test browser makes (host, path, method), blocks risky ones and swaps stand-in keys on approved hosts.	Not an OS-level firewall — your servers’ own outbound calls aren’t routed through it.
Self-healing	Re-finds moved or renamed elements from test id, label, text and structure, and logs every fix.	Repairs are suggestions — review them in your app’s context.
Checkpoints	Saves cookies, local and session storage, URL and a DOM snapshot, and restores them into new browser contexts.	No VM or process memory snapshots.
Time warp	Moves the clock for `Date` in the page and later navigations.	Browser timers, servers, databases, cron jobs and TLS keep real time.
Fixtures	Replays saved responses for matching browser requests.	Backend and worker traffic isn’t captured; unmatched requests pass through.
Chaos report	Watches a risky action and reports whether an idempotency key was sent.	Duplicate, dropped-connection and 502 scenarios are simulated, not executed.
Failure X-Ray	Adds W3C trace headers and records browser response details.	No backend or database telemetry, and latency isn’t measured yet.
Bug capsules	Turns a sanitized event capsule into a Playwright repro spec.	Redaction is best-effort and capsules aren’t encrypted — keep real user data out.
Signed evidence	A hash-linked, signed ledger per run that anyone with the key can verify.	Evidence only — not a SOC 2 or ISO certification.

Read the capability roadmap

Plans

Start free. Add the cloud when you need it.

Open source

Free

For anyone running tests on their own machines or CI.

Recorder, compiler and runner
Safety door and stand-in keys
Self-healing, checkpoints and the lab
Signed evidence and the local console

Get it on GitHub

Cloud

Early access

[YOUR PRICE]/ month

Hosted browser runs, submitted straight from CI.

Everything in Open source
Project API keys for CI
Run history and analytics in the console
Results posted to pull requests
Daily run allowance: [YOUR LIMIT]

Join early access

Enterprise

Custom

Your own deployment, endpoint and keys.

Dedicated endpoint via AIRLOCK_CLOUD_URL
Deployment-scoped credentials
Security review support
[YOUR SUPPORT TERMS]

Talk to us

Cloud pricing and run limits are still being finalized.

Questions

Good questions, short answers.

Not to get started. Record a test by clicking through your site; the console shows each step in plain words. The output is real Playwright code, so engineers can review and extend it later.

See a safe test run for yourself.

Open the demo console to explore runs, the safety door and signed receipts with sample data — or install AirlockQA and record your first test.

Explore the demo npm i -D airlockqa

Browser tests that can’t break real things.

From a few clicks to a signed result.

Record

Turn it into a test

Run it safely

Get a receipt

Everything a careful test needs, in one toolkit.

A safety door for every request.

When your design changes, tests find their way.

Save points: log in once, test many paths.

A receipt you can check, for every run.

Power tools, clearly labelled.

Time warp

Fixtures

Chaos report

Failure X-Ray

Bug capsules

Clear enough for the whole team.

Know what’s tested — in plain words.

Record tests by clicking.

It’s just Playwright.

Proof, not promises.

Five commands from zero to signed evidence.

What AirlockQA does today — and what it doesn’t yet.

Start free. Add the cloud when you need it.

Open source

Cloud

Enterprise

Good questions, short answers.

Do I need to know how to code?

Can a test touch real customers or real money?

What is a signed receipt, exactly?

Where do my tests run?

What does “Preview” mean?

Which browsers are supported?

See a safe test run for yourself.