Severity levels
Every detected issue is assigned a severity level:Critical
Immediate exploitation risk or user-blocking defect. Address before deployment.
High
Significant security exposure or serious accessibility barrier. High priority.
Medium
Notable risk or usability degradation. Should be addressed in the current sprint.
Low
Minor issue or best-practice deviation. Address when bandwidth allows.
Security issues
Security issues are detected by the Security Agent and mapped to OWASP and industry-standard vulnerability categories.UI/UX issues
UI/UX issues are detected by the UI/UX Agent and focus on WCAG 2.1 accessibility compliance and general UX best practices.How detection works
QAOS uses three detection methods:1
Deterministic handlers
Fast, code-based checks that analyze the raw DOM, cookies, HTTP response headers, or JavaScript source for specific patterns. Examples: checking the
HttpOnly flag on session cookies, scanning scripts for Math.random() used as a token generator.2
LLM evaluation
The agent sends page state (DOM, screenshot, accessibility tree) to an LLM with a structured prompt asking it to evaluate the page against specific issue definitions. This catches context-dependent issues that code patterns alone can’t detect.
3
Subtask-based testing
For certain issues, the agent proposes and executes interactive sub-tests — such as attempting to log in with known default credentials, submitting forms with XSS payloads, or trying to access protected resources after logging out.