Security

How TabQA connects to devices and processes test evidence locally

Device authorization, capture data, default redaction, retention, and export boundaries should be clear before installation.

Direct answer

TabQA accesses an Android phone the user explicitly authorizes in the browser's WebUSB chooser. ADB credentials, requests, logs, screenshots, video, and text-recognition results are processed locally by default and are not automatically uploaded to TabQA servers.

Device connection and permissions

  • The user confirms access in both the browser device chooser and the Android USB debugging prompt.
  • The ADB RSA private key is generated and stored in the browser; uninstalling requires authorization again.
  • The extension opens no local network port and exposes no arbitrary ADB command input.
  • The tabs permission is used only to open, locate, and focus TabQA's own USB authorization page.

How capture data is retained

DataHandling
Screenshots, video, logs, and reportsStored in browser IndexedDB, removed after seven days by default, or deleted immediately by the user
Raw whole-device logDeleted after extracting target-app and failure context unless explicitly retained
Network requestsCommon auth headers and fields containing token, secret, password, session, or auth are masked by default
Text recognitionChinese and English models ship with the extension; images and recognized text stay local
Exported filesLeave extension storage only after an explicit copy, download, or export action

What the user still needs to review

Automatic redaction cannot identify every application-specific field. Full logcat, HAR, screenshots, and video may still include account, device, or test-environment information and should be reviewed before sharing.

This page describes implementation boundaries. The privacy policy is authoritative for data policy and website log retention.

Sources and basis