Security
Recording stays local
The recorder sends only to the collector on 127.0.0.1. Recordings stay in .stresseur/recording.db. No telemetry.
The SDK runs only on localhost unless you set allowRemote: true.
Masked in the browser
- Headers:
authorization,proxy-authorization,cookie,set-cookie,x-api-key. - Fields named like password, token, secret, apikey, session, auth, otp, pin, cvv, card number, ssn.
- Values that look like card numbers or US SSNs.
- In recorded pages, the value of a password input, or of an input named like the fields above. A hidden CSRF token is kept: the test reads it from the page.
Masked values are sent to the collector only as hashes. Add field names with redact, exempt them with allowRaw.
Masked values never appear in generated flows: they become {{ #env:VAR }} references or links to an earlier response.
init writes the passwords the recording used to .env, then replaces them with *** anywhere else the recording kept them.
What reaches Stresseur Cloud
| When | What |
|---|---|
record, while logged in |
Call counts and endpoint paths |
generate, while logged in |
Flow and step names, methods, paths, verify result |
generate --upload |
The flow files |
| CI upload | Per-step timings, runner, repo and run metadata |
ci --capture failed |
Failed steps’ request and response, masked |
CI authentication
Uploads from GitHub Actions use OIDC. No token is stored.
Environment secrets are encrypted. The test engineer never sees their values. Data is stored in the US.
More: Security.