Is it safe to add TurnSignal to CI?

The reporter never changes Playwright's exit code and gives up quickly if our API is unreachable, so it can't fail your build. It needs one secret, the project token, and no access to your repository.

Will my secrets end up in TurnSignal?

Common secret formats in errors and traces are replaced with [REDACTED] in your CI before anything is sent. Redaction matches known patterns and secret-looking CI variables, so it can miss an unusual secret; you can add your own patterns.

Does TurnSignal see my source code?

No. It never receives your repository, and test source files are left out of uploaded traces unless you turn that on.

How do I delete my data?

Delete a project, an organization or your account yourself from the dashboard; the data, including screenshots, videos and traces, is removed right away.

Is TurnSignal safe to add to CI? Security and data

What runs in your CI

The turnsignal reporter runs inside your Playwright run, next to your other reporters. It never changes Playwright's exit code: your CI passes or fails exactly as it would without TurnSignal.
Results are written to disk in CI first. If our API is unreachable, the reporter gives up quickly and npx turnsignal upload sends the saved results later.
It needs one secret, the project token (TURNSIGNAL_TOKEN), which works only for that one project. It needs no access to your repository.

How secrets are kept out

Before anything is written to disk or sent, error messages, stacks and code snippets are scanned and credentials are replaced with [REDACTED]: Authorization headers, passwords in URLs, password=/api_key=-style values, common token formats, and the values of your CI's secret-looking environment variables (*TOKEN*, *SECRET*, *PASSWORD*, *KEY*). Errors are checked again on our servers.
Playwright traces are redacted in CI before upload: sensitive headers and cookies are blanked and secret patterns are replaced in the network log, console output and text resources. A trace that cannot be redacted safely is not uploaded.
You can add your own patterns with the reporter's redact option or TURNSIGNAL_REDACT.
Redaction matches known patterns, so it can miss an unusual secret. Commit messages, test titles, screenshots and videos are not redacted. Choose what to send with TURNSIGNAL_ARTIFACTS=trace,screenshot (or none); project owners can also turn artifacts off.
Background: Secrets in Playwright traces.

What TurnSignal receives and stores

Test names and file paths, outcomes, durations and attempts, error messages and stack traces (after redaction), branch, commit id and message, the commit author's name (turn off with TURNSIGNAL_SEND_AUTHOR=0), the CI job link, the runner's hostname and memory use.
Screenshots, videos and traces, only if your Playwright config records them and your project keeps them.
Never your source code, payment details or IP addresses in our database; no analytics or advertising trackers.
Data travels over TLS. The database (Neon, Postgres on AWS us-east-1) and our artifact storage are encrypted at rest. The full list of providers is in the privacy notice.

Retention and deletion

Test runs are deleted automatically after 90 days, or the retention period set for your project.
Screenshots, videos and traces: 30 days for failed and flaky tests, 7 days for passed tests, and always with their run.
You can delete projects, organizations and your account yourself; the data goes right away.
Questions or a copy of your data: email hello@turnsignal.ai.