qa-use

The server uses a broad CORS policy ('Access-Control-Allow-Origin', '*') for its HTTP mode, though it's protected by Bearer token authentication. Tunnel mode (`localtunnel`) exposes a local browser WebSocket endpoint to the public internet, which inherently increases attack surface. While it uses deterministic subdomains and secure defaults (HTTPS for tunnel host), users should be aware of the implications of exposing local services. Installation of Playwright browsers involves forking a child process (`playwright install chromium`), which is a privileged operation. No direct 'eval' or obvious malicious patterns are observed, and good practices like `--no-sandbox` for Playwright are used. The overall security relies heavily on the security of the `desplega.ai` platform and careful user configuration.