Skip to main content
QAOS detects issues across two broad domains — security and quality — using a combination of deterministic checks and LLM-powered analysis.

Severity levels

Every detected issue is assigned a severity level:

Critical

Immediate exploitation risk or user-blocking defect. Address before deployment.

High

Significant security exposure or serious accessibility barrier. High priority.

Medium

Notable risk or usability degradation. Should be addressed in the current sprint.

Low

Minor issue or best-practice deviation. Address when bandwidth allows.

Security issues

Security issues are detected by the Security Agent and mapped to OWASP and industry-standard vulnerability categories.
CategoryIssuesMax Severity
Access ControlUnauthenticated access, privilege escalation, forced browsing, method bypassCritical
AuthenticationDefault credentials, password spraying, rate limiting, weak passwordsCritical
Session ManagementSession ID in URL, weak tokens, missing HttpOnly flagCritical
InjectionXSS, SQL/NoSQL injection, ORM parameter extractionHigh
CryptographyUnencrypted pages, weak hashing, misconfigured headers, CORS, exposed secretsCritical
Information DisclosureExposed files, server version leakage, verbose error pages, console loggingCritical
Input ValidationUnvalidated input fieldsLow

Quality issues

Quality issues are detected by the Quality Agent and focus on WCAG 2.1 accessibility compliance and general UX best practices.
CategoryIssuesMax Severity
AccessibilityKeyboard navigation, screen reader support, color contrast, text sizeHigh
FormsLabels, error messages, required field indicatorsCritical
NavigationLink clarity, navigation consistency, destructive action confirmationCritical
Responsive DesignTouch targets, horizontal overflow, missing page titlesHigh

How detection works

QAOS uses three detection methods:
1

Deterministic handlers

Fast, code-based checks that analyze the raw DOM, cookies, HTTP response headers, or JavaScript source for specific patterns. Examples: checking the HttpOnly flag on session cookies, scanning scripts for Math.random() used as a token generator.
2

LLM evaluation

The agent sends page state (DOM, screenshot, accessibility tree) to an LLM with a structured prompt asking it to evaluate the page against specific issue definitions. This catches context-dependent issues that code patterns alone can’t detect.
3

Subtask-based testing

For certain issues, the agent proposes and executes interactive sub-tests — such as attempting to log in with known default credentials, submitting forms with XSS payloads, or trying to access protected resources after logging out.