E3QA
Security & Penetration Testing Agent
Runs vulnerability scans (SAST/DAST), dependency audits, and simulated attack scenarios.
How it runs
- What it reads
- Codebase, dependency manifest, threat model.
- What it produces
- Vulnerability report (CVSS-scored), remediation tickets.
- When it runs
- On every PR (lightweight) + full scan pre-release.
The same guardrails as every other agent
Security & Penetration Testing Agent is governed exactly like the rest of the fleet. Its rule file is versioned, never edited in place. Its tool list is a declaration, not a grant — it can only call a tool a gateway policy has explicitly allowed in that project. Every tool call it makes is policy-checked and written to the audit log before it leaves the platform, and a project's cost cap is checked before a run starts, not reconciled after it.
More in QA
- E1Functional Testing AgentGenerates and runs unit/integration/E2E tests (pytest, Playwright) against acceptance criteria.Read the product page
- E2Code Review AgentStatic analysis, style/quality gate, and architectural-consistency check before human review.Read the product page
- E4Performance/Load Testing AgentSimulates production load, measures latency/throughput, identifies bottlenecks.Read the product page
- E5UAT / Stakeholder Acceptance AgentCoordinates user acceptance testing with actual business stakeholders, packages test scenarios from acceptance criteria, and collects sign-off before the release gate.Read the product page
- 188Database Testing Agentindependently verifies schema migrations, query performance, and data integrity before and after they ship; distinct from the Database Development Agent, which self-reports on its own migrations and queries, and from Performance/Load Testing, which measures application-level throughput, not database-specific query plans or referential integrity.Read the product page
- 189Visual Regression Testing Agentcaptures screenshots of rendered UI across breakpoints and diffs them against an approved visual baseline to catch unintended visual regressions — layout shifts, broken CSS, misaligned components; distinct from Functional Testing (behavioral correctness against acceptance criteria) and the Accessibility Agent (semantic/WCAG compliance), neither of which verifies pixel-level rendered appearance.Read the product page
- 190Responsive Design Testing Agenttests rendered layouts across a continuous range of viewport widths, not just discrete breakpoints, for responsive correctness: content overflow, touch-target sizing, text truncation, and broken mid-range layouts between defined breakpoints; distinct from Visual Regression Testing, which diffs discrete breakpoint snapshots against a prior baseline and cannot catch a responsive flaw present since a screen's own first version, nor a bug that only manifests between listed breakpoints.Read the product page
- 191Source Code Auditing Agentperforms a periodic, whole-codebase audit, not scoped to a single PR diff, for hardcoded secrets, missing license/copyright headers, and code whose own structure closely resembles restrictively-licensed external sources; distinct from Code Review Agent, which gates new PR diffs against house style, and Security & Penetration Testing, which scans for known vulnerability patterns and CVEs rather than provenance or license risk.Read the product page