Playwright Specs

Traditional automated crawlers lack business context and frequently fail to traverse these workflows correctly. As a result, important parts of the application may remain untested.

To address this gap, ZeroThreat supports Playwright Specs integration. You can use your existing Playwright test suites to execute real business workflows during security scans. This ensures deeper coverage across conditionally accessible features and complex user flows that automated crawling alone cannot reach.

Setting Up Playwright Specs in ZeroThreat

Step 1: Navigate to Targets

Go to the Targets section from ZeroThreat dashboard

Step 2: Select the Target

Click on the specific target you wish to configure. This will open the Target Configuration settings.

Step 3: Open Playwright Specs

Inside Target Configuration, click on the Playwright Specs section.

You will see two options to upload or connect your Playwright project. However, before importing your Playwright Specs, you must first configure them to run through the ZeroThreat proxy so they can execute correctly during scans.

Two Quick Ways to Create Playwright Specs (Optional)

If you do not already have a Playwright project, these are two of the quickest ways to get started from an empty directory and create working specs.

mkdir playwright-specs
cd playwright-specs

npm init -y

npm init playwright@latest

npx playwright codegen https://your-target-url.com

mkdir -p tests

tests/login-flow.spec.ts

npx playwright test

mkdir playwright-specs
cd playwright-specs

npm init -y

npm init playwright@latest

npx playwright init-agents --loop=vscode

npx playwright init-agents --loop=vscode

import { test } from '@playwright/test';

test('seed', async ({ page }) => {
  await page.goto('https://your-app-url.com');
});

tests/seed.spec.ts

Generate a plan for a Playwright spec that logs into the application, opens the billing page, verifies that the invoices table is visible, and logs out. Use tests/seed.spec.ts as the seed test. Keep the plan focused only on this flow.

tests/billing-flow.spec.ts

npx playwright test

npx playwright test tests/billing-flow.spec.ts

Once the spec runs successfully, it is ready to be adapted for ZeroThreat by applying the proxy configuration described below.

Configuring Playwright Specs to Run in ZeroThreat

To allow ZeroThreat to execute your existing Playwright tests, you must configure them to route traffic through the ZeroThreat proxy and prepare the project so it runs reliably during scans.

Before importing your Playwright project into ZeroThreat, make sure your project is prepared correctly. At the top of your playwright.config.ts, ensure that devices is imported. For example:

import { defineConfig, devices } from '@playwright/test'

In your default Playwright configuration, keep the project running in headless mode. If you already have headless: true set, keep it as it is. Otherwise, do not explicitly add or override this setting.

You should also structure your Playwright project so that each individual spec completes within 30 seconds. This is the timeout used for Playwright Spec execution inside ZeroThreat. You can have as many individual specs as needed, but each spec should stay within that limit to ensure the best coverage.

Inside your playwright.config.ts, add the following project configuration under projects:

{
    name: 'ZT-Proxy-Chromium',
    use: {
        ...devices['Desktop Chrome'],
        proxy: {
            server: 'http://localhost:8000',
        },
        ignoreHTTPSErrors: true,
    },
}

This ensures that Playwright traffic flows through the ZeroThreat scanning engine.

Inside your package.json, add the following script under scripts:

"zt:test": "npx playwright test --project=ZT-Proxy-Chromium"

After these changes, your existing Playwright Specs will automatically execute within ZeroThreat without requiring any modifications to your test spec logic.

Upload Methods

Method 1: Import from GitHub

Use this method to connect your existing Playwright GitHub repository directly to ZeroThreat using the ZeroThreat GitHub App.

Follow these steps:

1. Click the Connect Your GitHub Repository card. In the popup, click Connect GitHub.

2. You will be redirected to the GitHub App access page.

3. Select the repository that contains your Playwright Specs and grant access to the ZeroThreat AI GitHub App. Click Save to complete the GitHub App authorization.

4. After the connection is successful, you will see a GitHub App Installed confirmation page.

5. Back in ZeroThreat Portal, select:

• your repository
• the path to your Playwright Specs in the repository
• optionally, the branch name

6. Click Save.

Once connected, your Playwright Specs will be used to improve coverage in future scans.

Method 2: Upload a ZIP File

You can also upload your Playwright project directly.

1. Create a .zip file of the project containing playwright specs
2. Ensure that playwright.config.ts is present in the root directory of the ZIP
3. Upload the ZIP file

Once uploaded, your Playwright Specs will be listed in the Playwright Specs section for that target.

Viewing Playwright Specs During a Scan

Once Playwright Specs are configured for a target, they will automatically run when you initiate a scan.

In Scan Report

After the scan completes:

• Open the Scan Report
• In the top-right dashboard, you will see a Playwright section

• Clicking it will display:
  • All specs executed during the scan
  • Execution status (Pass / Fail)
  • Execution time per spec

During an Active Scan

While a scan is running, you can monitor Playwright spec execution progress within the AI-Driven Penetration view.

A dedicated Playwright Spec block will display:

• Currently running specs
• Execution status
• Runtime information

This allows you to verify that critical workflows using Playwright specs are being tested as expected.

Why Use Playwright Specs?

Integrating Playwright Specs provides:

• Coverage for multi-step and stateful workflows
• Testing of conditionally accessible features
• Improved attack surface exploration beyond ZeroThreat static crawling

By combining crawler-based discovery with business-aware execution flows, ZeroThreat ensures more realistic and comprehensive security testing.

Summary

Playwright Specs enable you to bring real business workflows into your security scans. By reusing existing automation suites, you can significantly improve coverage of critical application features that traditional crawlers cannot reliably test.

Once configured, Playwright execution becomes a seamless part of your scanning process, providing visibility, control, and deeper testing across your application’s most important flows.