TestForge User Guide

A complete walkthrough — from signing up to running production audits. TestForge audits any web application just by pasting its URL. No SDK, no source code, no browser extensions.

Welcome to TestForge

TestForge is an AI-powered automated testing platform that audits web applications for bugs, security vulnerabilities, compliance gaps, and performance issues — all without needing access to your source code.

What TestForge checks:

• Security — SQL injection, XSS, open redirects, exposed APIs, missing headers
• Data leaks — Exposed emails, phone numbers, Aadhaar/PAN, tokens in source code
• Broken functionality — 404 pages, broken forms, JavaScript errors, slow load times
• Compliance — CERT-In, STQC, DPDP Act 2023, OWASP Top 10, RBI guidelines
• AI Recommendations — Smart fixes and improvement suggestions generated by AI

Step 1: Sign Up

Step 2: Pay ₹10 & Get Verified

Step 3: Run Your First Audit

Authenticated Audits (Testing Protected Pages)

If your app has a login wall, provide test credentials so TestForge can log in and audit protected pages:

1. Enter the login email and password in the form
2. If your app uses OTP-based 2FA, pre-generate the OTP and paste it in the optional OTP field
3. TestForge will automatically detect email/password fields, fill them, click submit, and wait for OTP screens
4. Session cookies are reused for all subsequent audit tests

Step 4: Understanding Your Results

After the audit completes, you'll see a detailed report with these metrics:

What each section means

• Pages Found: All URLs discovered during the crawl phase. More pages = more thorough audit.
• Bugs Detected: Every bug, vulnerability, or issue found. Each comes with a severity rating and fix recommendation.
• AI Test Cases: Smart tests generated specifically for your app's structure. The AI analyzes your forms, navigation, and API calls.
• Compliance Score: How well your app meets Indian regulatory standards. 80%+ is good; below 50% needs immediate attention.

Bug Severity Levels

Step 5: The Dashboard

After logging in, the Dashboard is your home base. It gives you a bird's-eye view of everything:

Dashboard Sections

Step 6: Managing Projects

Step 7: Reading & Sharing Reports

What's in a report?

• Header — Project name, URL, generation date, total duration
• Metric Cards — Pages found, bugs detected, AI test cases, compliance score
• Summary — Key findings and pass/fail status for each audit phase
• Compliance Breakdown — Per-suite scores (CERT-In, STQC, DPDP, VAPT, Payment Gateway)

Sharing reports

Reports are stored permanently. Each report has a unique URL you can bookmark. To share:

1. Open the report in your browser
2. Use Ctrl+P / Cmd+P to save as PDF
3. Share the PDF with clients or stakeholders

You can also enter a recipient email before running an audit to get the report delivered directly to their inbox.

Pricing & Plans

To upgrade from Free to Pro, go to /pay after logging in to complete the ₹10 verification.

Compliance Suites

TestForge maps to 162+ compliance controls across Indian and international standards:

API & CI/CD Integration

Run audits from your pipeline

curl -X POST https://testforge.kavachbrowser.com/api/audit/run \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com",
    "credentialProfile": {
      "loginUrl": "https://your-app.com/login",
      "username": "test@example.com",
      "password": "your-password"
    },
    "reportEmail": "qa@your-company.com",
    "browser": "chromium"
  }'

The API returns { ok: true, reportUrl, results, emailSent }. Add this to your GitHub Actions, GitLab CI, or Jenkins pipeline to run audits on every deployment.

Full audit via API (with project creation)

curl -X POST https://testforge.kavachbrowser.com/api/run-all \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -d '{
    "url": "https://your-app.com",
    "name": "Production Audit",
    "email": "test@example.com",
    "password": "test-password",
    "recipientEmail": "reports@your-company.com"
  }'

Reference: API Endpoints

Frequently Asked Questions