-
-
Notifications
You must be signed in to change notification settings - Fork 0
Automation Engine Guide
Evie edited this page Apr 29, 2026
·
1 revision
SeaViperCascade includes a Playwright-based automation engine intended to help automate password-changing flows.
This is one of the most experimental and security-sensitive parts of the project.
Automation exists in the codebase but still needs serious end-to-end testing.
Recent hardening added:
- Safer automation target URL validation
- Automation job ownership checks
- Automation job expiration
- Reduced long-term exposure of generated passwords
The automation engine is intended to:
- Navigate to supported login/password-change pages
- Assist with password update workflows
- Generate or use replacement passwords
- Track automation job status
Automation is risky because it interacts with websites and credential flows.
The app should avoid:
- Navigating to unsafe local/private targets by default
- Keeping generated passwords in job results indefinitely
- Letting one session access another session's automation jobs
- Running automation against untrusted URLs
- Exposing secrets through logs or API responses
The automation system now includes:
- URL safety checks
- Job ownership scoping
- Job expiration
- More restrictive handling of generated secrets
- Start automation job
- Track automation job status
- Confirm job expires correctly
- Confirm one session cannot access another session's job
- Confirm unsafe URLs are rejected
- Confirm generated passwords are not exposed longer than necessary
- Test successful automation on supported websites
- Test graceful failure on unsupported websites
Automation behavior is not yet considered stable.
Website flows vary heavily, so automation may fail depending on the platform.