Trusted with
your logins
Regress logs in to your app and visits every page. Here's exactly how that login is captured, locked down and used, what gets stored, and how to keep the risk close to zero.
Your login
Recorded loginqa@acme.dev · ••••••••
AES-GCMencrypted before saving
Storedenc:9f2ac41b7e0d…
Deploy webhooks
POST /webhook/deployx-regress-signature
Signature checkHMAC SHA-256
Scan startedsigned with your secret
Unsigned request rejected · 401
Protection
Your access stays yours
The things that let Regress into your app are locked down before they're saved, and anything that triggers a scan has to prove where it came from.
Encrypted logins
Saved passwords, tokens and recorded login steps are encrypted with AES-GCM before they're stored.
Signed webhooks
Deploy webhooks need a valid HMAC SHA-256 signature from your project secret, or they're rejected.
Tokens used once
The GitHub token you enter only verifies access to the repository. It isn't stored.
Data
What Regress keeps
Only what it needs to compare one deploy with the next and show you what broke.
- Page fingerprints
- The forms, tables, links and buttons on each page, used to spot changes.
- Screenshots and snapshots
- What each page and test step looked like, so failures come with proof.
- Scan results
- Which flows passed or failed, the steps they took and how long they took.
- Your login
- Only if you set one up. Login details are encrypted, and the latest session cookies are kept so scans can reuse them.
Infrastructure
Runs on Cloudflare
The app, the database, file storage, the scanning browsers and the AI that reads your pages all run on Cloudflare.
- Cloudflare Workers
- Runs the app and the API
- Cloudflare D1
- Stores projects and scan results
- Cloudflare R2
- Stores screenshots and page snapshots
- Cloudflare Browser Rendering
- Runs the browsers that scan your app
- Cloudflare Workers AI
- Reads changed pages to find flows
- Use a test account
- Give Regress its own login with only the access a normal user has.
- Scan staging for risky flows
- Tests click through your app like a user. Point Regress at staging if a flow would place real orders.
- Rotate secrets whenever you like
- Replace the webhook secret or disconnect GitHub from Project settings at any time.
Report a vulnerability
Found something? Email us with the steps to reproduce it. You'll hear back within 48 hours.
dirk@stoffberg.dev