TestCase Studio - Selenium IDE

AI Security Review

Evidence context: threat category none; evidence quality moderate.

TestCase Studio records what you do on a web page and turns the steps into plain-English test cases, positioned as an alternative to Selenium IDE. Version 3.0.4 has around 80,000 users and lists [email protected] as developer, the address behind SelectorsHub, a widely installed element picker.

The scan returned 47 medium findings and nothing above medium: 46 network matches and one manifest check. There are no malware signature matches, no known-bad domains, no obfuscated files, no hardcoded secrets, no dependency problems and no code-quality hits. Every network flag is a fetch or jQuery AJAX call, and the file names say what each one is for. extension/jira.js carries seven of them, at lines 195, 203, 330, 354, 360, 661 and 697, because the extension reads and writes Jira issues through that service's REST API. extension/bugasura.js:140 does the same against Bugasura, a second bug tracker. testCaseStudio/login.js:98 and testCaseStudio/profile.js:150 handle account sign-in and profile data for the developer's own service. extension/background.js (lines 3, 28, 32) and extension/captureEvents.js (lines 359, 362) are the service worker and the recorder that sends captured steps to whichever destination the user has configured.

That is the product working. A recorder that cannot file a finished test case into a tracker would be useless, and the scanner's network rules match the shape of an HTTP call regardless of destination.

A skeptic would push back on the capability, and reasonably so. A test recorder installs a content script that sees every page you visit, and testCaseStudio/login.js:98 shows it talks to a login endpoint on a server this evidence does not name. If it were shipping page content to an unknown host, that would be serious. Two things argue against it. First, the destinations on the Jira and Bugasura calls are fixed by those products' APIs, and the files are named for the integrations the extension advertises. Second, a hidden upload path would leave traces: an unfamiliar domain in the IoC set, a string-built URL, a packed payload. The scan contains none of those, and its IoC, obfuscation, secret and dependency categories all came back empty.

The real gap here is documentation rather than behaviour. The bundle records no permission strings and no endpoint addresses for this version, so the list of sites the extension can reach is unreported, and one manifest check is present without detail. Treat the permission list as unsurveyed. Anyone who needs certainty about which servers receive recordings can read the manifest and the endpoint constants directly; nothing in the scan points to a destination worth worrying about.

Key Reasons

• All 46 network findings are fetch or jQuery AJAX pattern matches in files named for known integrations: extension/jira.js, extension/bugasura.js, testCaseStudio/login.js and testCaseStudio/profile.js
• Zero malware signatures, zero IoCs, zero obfuscation findings, zero secrets and zero dependency findings across 47 total findings
• Publisher [email protected] is the developer behind SelectorsHub, with 80,000 users on version 3.0.4
• No custom search domains, no URL template construction, no cookie access and no new tab replacement anywhere in the findings
• Network traffic to Jira and Bugasura APIs is the extension's advertised function, not an unexplained endpoint

False Positive Considerations

• Network rules match the shape of any fetch or XHR call regardless of destination
• Findings cluster in files named for legitimate third-party APIs (jira.js, bugasura.js)
• No supporting evidence categories fired: zero malware signature, IoC, obfuscation, secret or dependency findings
• Known publisher with an established extension portfolio and a large installed base

Reviewed 2026-10-14; recommended action: suppress false positive; model confidence 84%.