One platform for test generation, execution, healing, and reporting.
AI Test Generation
Point QualityMax at any URL. Our AI crawls your application like a real user — clicking, filling forms, navigating — and generates production-ready Playwright tests.
- Real selectors from live DOM — no hallucinated locators
- Handles login flows, cookie consent, SPAs
- Multi-model AI for maximum accuracy
- Works behind auth with test credentials
Explore
// Generated by QualityMax AI
import { test, expect } from '@playwright/test';
test('login and verify dashboard', async ({ page }) => {
await page.goto('https://app.example.com');
await page.getByLabel('Email').fill('user@test.com');
await page.getByLabel('Password').fill('secure123');
await page.getByRole('button', { name: 'Sign in' }).click();
await expect(page).toHaveURL('/dashboard');
await expect(page.getByText('Welcome')).toBeVisible();
});
Self-Healing Scripts
UI changes break tests. QualityMax detects selector changes, analyzes the new page structure, and automatically repairs your scripts — no human intervention needed.
- Detects broken selectors before you do
- Multi-tier healing: selector → structure → AI rewrite
- Confidence scoring for every repair
- Zero maintenance overhead
Explore
// Before: selector broke after UI redesign
page.locator('#old-submit-btn') // Not found
// QualityMax auto-healed to:
page.getByRole('button', { name: 'Submit Order' })
// Confidence: HIGH (98%)
// Reason: Button text unchanged, ID removed in redesign
// Verified: Test passes with new selector
CI/CD Integration
Tests run automatically on every push. GitHub Actions, webhooks, n8n workflows — QualityMax plugs into your existing pipeline.
- GitHub Action: one YAML, tests on every PR
- Webhook API for any CI system
- n8n node for workflow automation
- Results posted back to your PR as a comment
Explore
# .github/workflows/qualitymax.yml
name: QualityMax Tests
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: Quality-Max/qualitymax-action@v1
with:
api-key: ${{ secrets.QUALITYMAX_KEY }}
project-id: 42
Security Scanning
QualityMax runs OWASP-aligned security checks during every AI crawl. It doesn't just find theoretical risks — it tests real attack vectors against your live application and reports exploitable vulnerabilities.
- Reflected & stored XSS: injects payloads into search, forms, URL params
- IDOR detection: accesses resources with other users' IDs to confirm broken authorization
- CSRF validation: checks every state-changing form for missing tokens
- Broken access control: tests admin endpoints with regular user sessions
- Mass assignment: sends extra fields (role, isAdmin) in profile update requests
- Session security: checks cookie flags (Secure, HttpOnly, SameSite)
- Information disclosure: detects exposed credentials, stack traces, debug endpoints
- SAST integration: Semgrep + Bandit + pip-audit on imported repositories
Run a security scan
// Real security scan output from QualityMax
// Target: https://preview-abc.yourapp.com
CRITICAL Reflected XSS
Path: /search?q=<script>alert(1)</script>
Input reflected in innerHTML without DOMPurify
Impact: Session hijacking, credential theft
HIGH IDOR — Horizontal Privilege Escalation
Path: GET /api/users/42/billing
User #1 can access user #42 billing data
Missing: req.user.id !== params.id check
MEDIUM Missing CSRF Protection
Path: POST /api/settings/password
No CSRF token, no SameSite=Strict cookie
MEDIUM Session Cookie Misconfiguration
Set-Cookie: session=abc; Path=/
Missing: Secure, HttpOnly, SameSite flags
LOW Password in API Response
GET /api/admin/users returns password field
Scan: 23 endpoints tested | 2 critical | 3 high | 4 medium
Performance Testing with k6
Generate production-grade k6 load tests from your OpenAPI spec, existing Playwright tests, or plain URL. Supports load, stress, spike, soak, and breakpoint testing profiles with cloud execution and real-time dashboards.
- Auto-generate k6 scripts from OpenAPI/Swagger specs
- Convert from JMeter (.jmx), Gatling (.scala), Locust (.py), or Playwright
- 5 test profiles: load (steady), stress (ramp), spike (burst), soak (endurance), breakpoint (find limits)
- Cloud execution with configurable VUs, duration, and thresholds
- Real-time metrics: p95/p99 latency, throughput, error rate, TTFB
- Threshold-based pass/fail: "p95 < 500ms" or "error rate < 1%"
- API security testing: auth token injection, rate limit verification
- HTML reports with waterfall charts and percentile breakdowns
Generate a load test
// k6 stress test — generated by QualityMax
// Source: OpenAPI spec for /api/checkout
import http from 'k6/http';
import { check, sleep } from 'k6';
export const options = {
stages: [
{ duration: '1m', target: 50 }, // ramp up
{ duration: '3m', target: 200 }, // sustained load
{ duration: '1m', target: 500 }, // stress peak
{ duration: '2m', target: 0 }, // ramp down
],
thresholds: {
'http_req_duration': ['p(95)<500'],
'http_req_failed': ['rate<0.01'],
},
};
export default function() {
const login = http.post('https://api.example.com/auth',
JSON.stringify({ email: 'load@test.com', pass: 'test' }),
{ headers: { 'Content-Type': 'application/json' } }
);
check(login, { 'login 200': (r) => r.status === 200 });
const token = login.json('token');
const cart = http.post('https://api.example.com/cart',
JSON.stringify({ product_id: 42, qty: 1 }),
{ headers: { Authorization: `Bearer ${token}` } }
);
check(cart, { 'cart 201': (r) => r.status === 201 });
sleep(1);
}
// Results: p95=312ms | p99=487ms | throughput=847 req/s
// Errors: 0.2% | Status: PASSED (all thresholds met)
Native Mobile App Testing
Test real iOS and Android apps in the cloud — no physical devices, no emulator setup. QualityMax streams native apps via Appetize.io and generates touch-interaction tests using the same AI pipeline.
- Real iOS (iPhone 15, iPad Pro) and Android (Pixel 7, Galaxy S24) devices
- Upload .ipa or .apk — app streams in the cloud, no local install
- AI discovers native screens: taps, swipes, text input, navigation
- Generates Playwright tests with mobile-specific selectors and gestures
- Accessibility tree extraction for native elements (not WebView-only)
- Device viewport emulation for responsive mobile web testing
- Screenshot + video capture on real device resolutions
- Combined web + native coverage in a single project
Test your mobile app
// Native iOS app test — generated by QualityMax
// Device: iPhone 15 Pro (via Appetize.io)
import { test, expect } from '@playwright/test';
test.use({
viewport: { width: 393, height: 852 },
deviceScaleFactor: 3,
isMobile: true,
hasTouch: true,
});
test('iOS app — login and browse catalog', async ({ page }) => {
// App streamed from Appetize.io session
await page.goto('https://appetize.io/app/YOUR_APP_ID');
// Tap "Sign In" on the native splash screen
await page.getByRole('button', { name: 'Sign In' }).tap();
// Fill native text fields
await page.getByPlaceholder('Email address').fill('demo@app.com');
await page.getByPlaceholder('Password').fill('demo123');
await page.getByRole('button', { name: 'Log In' }).tap();
// Verify home screen loaded
await expect(page.getByText('Welcome back')).toBeVisible();
// Swipe through product carousel
await page.locator('.product-carousel').evaluate(
el => el.scrollBy({ left: 300, behavior: 'smooth' })
);
});
// Devices tested: iPhone 15, Pixel 7, iPad Pro 11"
// Results: 3/3 passed | Screenshots captured
Quality Dashboard
One view for all your testing metrics — pass rates, coverage gaps, quality scores, and trends over time. Know exactly where your test suite is strong and where it's blind.
- Project-level quality scores (A-F grading, 0-100 scale)
- Test coverage gap analysis: which flows have no tests?
- Execution history with screenshots, videos, and console logs
- Self-healing activity log: which selectors were repaired and when
- Team activity dashboard: who ran what, when, results
- AI-powered suggestions: "Add a test for the password reset flow"
See your quality score
Quality Score: B+ (82/100)
Tests: 47 total | 43 passed | 4 failed
Coverage: 78% of critical user paths
Self-healed: 6 scripts auto-repaired this week
Avg execution: 12.4s per test
Flakiness: 2.1% (down from 14% last month)
Coverage gaps found:
Missing Password reset flow (high priority)
Missing Payment failure error state
Weak Checkout only tests happy path
Weak No test for session expiry behavior
Info Logout + back button not covered
AI suggestion:
"Generate 3 tests for the password reset flow.
This is your highest-priority coverage gap."
