# Every test run also checks your shop for signs of hacking. While your tests click through your shop, Forge QA watches for the tell-tale signs of a hacked page: visitors sent to a fake store, a script copying card details, code that shouldn't be there. You see the results in their own Security tab, next to the test results. - **In every plan.** No add-on, no extra charge. - **Never fails your test.** A security warning is never mixed up with a pass or fail. - **No setup.** It runs during the tests you already have. ## Why a test tool checks security A hacked shop still passes its tests. Shops get hacked in quiet ways. When attackers tamper with a theme file, an app or a script from another company, the shop keeps working. Products load, the cart fills, checkout opens. Meanwhile some visitors are sent to a fake copy of the shop, or hidden code quietly copies their card details. An uptime monitor only sees that the page loads. A normal test sees a working checkout. Forge QA makes the tests you already run notice: every run also checks the scripts the page loads and the sites it contacts. ## What you see after a run Your test results stay on their own tab: steps, screenshots, video and logs. Security gets a separate tab with the number of findings on it, so a pass or fail is never mixed up with a security warning. Each finding says what happened, how serious it is and which web address was involved. The tab also shows how many scripts were checked, whether any scripts from other sites are new or changed since the last run, and the AI second opinion when one was needed. Example run with made-up web addresses. ## What it looks for Fixed rules check every page your tests visit. The same page always gets the same result. - **Visitors sent to other websites,** such as a fake copy of your shop. - **Card-skimming scripts** that read the card fields and send the data away. - **Forms that send passwords or card details** to another website instead of yours. - **Hidden code** that unpacks itself and runs. - **Crypto miners** that slow the page and run on your visitors' devices. - **Hidden frames** that load another website inside your page. - **New or changed scripts from other sites** since the last run, even when nothing else looks wrong. **AI as a second opinion.** When the rules find nothing wrong, yet a script from another site is new or has changed since the last run, AI looks at it and says whether it seems harmful. It only sees the script's address and short excerpts, and it never fails your test. ### Technical details Every rule, its severity and what is kept. For developers. Deterministic rules, run in the browser container during the test. The same script gives the same result every time. - High**Off-site redirects**: The page tries to send visitors to a domain that isn't one of the website's approved destinations. This is how hijacked stores push shoppers to fake ones. - High**Card-skimmer patterns**: A third-party script reads card fields, encodes the data and sends it out: the Magecart pattern. Scripts from known payment providers and Shopify are excluded. - High**Forms that post elsewhere**: A form with password or card fields submits to another site instead of yours. - High**Hidden code execution**: A script decodes a string and runs it with eval or Function, a common way to hide injected code. - High**Crypto miners**: Known in-browser mining code, which slows the page and runs on your visitors' devices. - Medium**Hidden third-party frames**: An invisible iframe loads another origin, often used for tracking or injected content. - Medium**Injected markup**: A script writes decoded or unescaped markup into the page with document.write. - Medium**Scripts from bare IPs**: A script is served from an IP address instead of a domain name. - Low**Unapproved requests**: The page requested an origin that isn't one of the website's approved dependencies. Worth a look, often harmless. - Low**Obfuscated code**: Heavily obfuscated code (long runs of hex escapes), because legitimate bundles rarely look like that. ### Script inventory Every run records up to 60 scripts its pages loaded, with a SHA-256 hash of each. When the rules find nothing, Forge QA compares the hashes with the test's previous run to spot third-party scripts that are new or changed. A new third-party script on your checkout deserves a look even when nothing else is wrong. ### AI review Rules are predictable and cheap, so they always run first. When they find nothing, yet a third-party script is new or changed, AI reviews the risky parts of that script and says whether it looks harmful. The model sees the script's URL and short excerpts around calls like eval, atob, sendBeacon or fetch, not the whole bundle. The excerpts are used only for that review; the run keeps URLs and hashes. The verdict (clean, suspicious or malicious) and its reasons appear with the run's security findings, and it never fails your test. Up to eight scripts per run and 30 reviews per workspace a day; the review doesn't count against your AI actions. ## What it is not We would rather you know the limits than trust it blindly. - Not a penetration test, and not a check of your server for weak spots. - It only sees the pages your tests visit, in the browsers they run in. - It doesn't block anything on your live shop. It tells you, and you decide. - A clean result is not a guarantee. It is an extra pair of eyes on every run. ## Not found in other test tools In October 2026 we searched the public sites and docs of Reflect, Ghost Inspector, BugBug and mabl for anything similar: spotting card skimmers, checking third-party scripts, scanning pages for signs of hacking. We found nothing comparable. [See the full comparisons](https://forgeqa.io/compare/) ## Your next test run checks security too. Included in the 7-day trial and every plan. --- Source: https://forgeqa.io/security-scan ยท Start a free trial: https://app.forgeqa.io/#signup Summary: Every Forge QA test run also checks your shop for signs of hacking: visitors sent to other sites, scripts reading card details, new scripts since the last run. Included in every plan, shown in its own Security tab, and it never fails your test.