Forge QA home
DE Start free trial

How Forge QA is built

A Rust backend, Postgres that separates workspaces in the database itself, Playwright in disposable containers, and a network guard on every run. Here is what that means for your tests and your data.

What happens when a test runs

  1. TriggerA schedule, a CI trigger or a click on Run.
  2. APIRust and axum. Checks the plan, reserves the run and queues it.
  3. ContainerA fresh, disposable container with Playwright and the browser you chose.
  4. Network guardLets the browser reach only the origins approved for this website.blocked: private addresses, unapproved origins
  5. Your websiteThe test runs against your site. Results, evidence and security findings go back to your workspace.

The parts, and why we chose them

  • Rust and axum

    The API and billing logic are written in Rust on the axum web framework. Fast, memory-safe, and strict about types where money and permissions are involved.

  • Postgres with row-level security

    Every workspace's data is separated by row-level security in the database itself, not only in application code.

  • Playwright

    Playwright drives Chromium, Google Chrome, Microsoft Edge, Firefox and Safari (WebKit). Traces come straight from Playwright, so you can open them in its trace viewer.

  • Safari (WebKit), not the Safari app

    WebKit is the engine inside Safari and catches most Safari-specific issues. It is not Apple's Safari app on a Mac or iPhone, and we don't claim it is.

  • One container per run

    Each run starts in its own disposable container, so no cookies, storage or state carry over from another run or another customer.

  • A network guard per run

    The browser can reach only the origins approved for that website. Private and internal network addresses are blocked, so a test can't be turned against internal systems.

  • Secrets stay secret

    Test secrets are stored encrypted and referenced by name. Passwords and secrets are masked in screenshots and logs.

  • Security scan in every plan

    Deterministic checks run during every test; AI only gives a second opinion on new third-party scripts. Details

  • Evidence with an expiry

    Screenshots, video, traces and logs are deleted after 7 days on the trial and 14 to 60 days on paid plans. Run history stays, so you keep the record without the bulk.

AI through OpenRouter

Test writing, ForgeAI review, AI Buddy, self-healing, the assistant and the scan's second opinion all use AI. All of it goes through OpenRouter.

  • The right model for each job. OpenRouter lets us choose the model per task, and switch when a better one appears.
  • No lock-in to one AI vendor. Not for us, and not for you.
  • Bring your own key. On Agency you can connect your own OpenRouter key and choose which of the supported models it uses.
  • What the model sees. The prompt and the page content needed for the task. For the security review, only short excerpts of new scripts.

Services we rely on

  • Hetzner hosts everything in its Falkenstein data center in Germany: the website, the app, your data and the test browsers.
  • Cloudflare sits in front of forgeqa.io and the app to absorb attacks.
  • Stripe for payments and for identity verification. Stripe handles ID documents; we don't store ID images.
  • OpenRouter for AI models.
  • Resend for account and notification email.
  • Slack and Atlassian (Jira Cloud) only if you connect them.

See it run against your site.

7 days, 100 runs, no credit card.

Start free trial All features