# Test credentials and browser data

Use test accounts and choose an environment where the authored actions are appropriate. Zerocheck needs enough page context to run the test and explain its result; choose your evaluation flows with that data access in mind.

## What leaves the local runner

Local runs use Zerocheck's authenticated AI service and upload selected test definitions, run results and artifacts. AI interactions can send a screenshot, an accessibility representation of the page, its URL and title, and recent action context.

Running the browser on your machine gives it access to addresses your machine can reach. It does not make execution offline or remove the service dependency.

## How to supply credentials

Reference secrets by name in the environment configuration and test steps. Your local environment supplies local-run values; the instance owner configures hosted credential values and allowed target hosts. Missing required values stop the run before a browser opens.

Only explicitly referenced test secrets are resolved. Keep credentials out of test descriptions and committed YAML. Reusable login steps run before the test and should finish with an expected logged-in state.

## What is masked

Configured secret values are redacted from model observations and saved text. Screenshots mask inputs, configured visible secret values and cross-origin frames. This is not general personal-data removal: other application data can still appear in page observations or artifacts.

Video is omitted when configured secrets are present because recordings cannot apply the same masking. For credential-free flows, each attempt can include a recording.

## Actions and environments

Choose dev, staging or production explicitly. The browser agent applies action policies that block destructive account or data actions and bulk sends. Payments can be allowed and logged, so use a test environment and the payment provider's test mode where appropriate; choosing production does not make a run read-only.

Zerocheck supports ordinary browser interactions with payment screens, but it does not provide a special test-card completion command or inbox service. Configure the flow and test data your app actually supports.

## Results and access

Hosted results are stored on your instance. Local results are kept under `.zerocheck/` and uploaded to the service. There is no advertised automatic retention or deletion period; discuss your storage requirements during onboarding.

Selected failing screenshots and recordings can receive share links for pull request reporting. Anyone with such a link can access the shared artifact, and those links do not have an automatic expiry. Review what your tests expose before sharing evidence outside your team.

[Supported flows](https://tryzerocheck.com/docs/limits/) · [Result evidence](https://tryzerocheck.com/docs/results/) · [Privacy policy](https://tryzerocheck.com/privacy/) · [Contact sales](https://tryzerocheck.com/demo/)

---
Canonical: https://tryzerocheck.com/docs/security/
Updated: 2026-09-14