Security
RunnerQA is built local-first: your app and your devices stay under your control, and the cloud only holds what it needs to.
Test execution stays on your machine
RunnerQA never installs, launches, or controls your app from the cloud. Tests run locally through the RunnerQA CLI on your own simulators, emulators, or devices. Your app binaries are never uploaded. What RunnerQA stores in the cloud: test definitions, generated YAML, run results, and the logs your CLI chooses to report.
Tokens are hashed, shown once, and revocable
Runner tokens (CLI) and agent tokens (Agent API) are stored only as SHA-256 hashes — we cannot read them back, and neither can anyone who reads the database. Each token is shown exactly once at creation, is identified by a short prefix, and can be revoked instantly from the dashboard. Runner and agent tokens are separate credentials with separate scopes.
Your data is isolated per account
Every project, test case, and run is scoped to your account and enforced at the database layer with row-level security. Token tables are not readable through any client-facing API. AI agents using the Agent API can only see resources owned by the token's account.
AI processing
When you generate a test or request a failure analysis, the test description, YAML, and relevant failure logs are sent to the Anthropic API to produce the result. This data is used to generate your test artifacts — it is not sold or shared beyond that processing. Generated YAML is validated against an allowlist of Maestro commands before it is stored; script-execution commands are rejected.
Where we are honest about limits
RunnerQA is in beta. We have not yet completed formal certifications such as SOC 2. We keep the attack surface small by design: local-first execution, a minimal API, hashed credentials, and strict per-user isolation. If your team has requirements we don't meet yet, tell us — it directly shapes the roadmap.
Reporting a vulnerability
If you find a security issue, please email support@runnerqa.dev with “Security” in the subject line instead of opening a public issue. We'll acknowledge your report, keep you updated while we fix it, and credit you if you'd like. See also our privacy policy.