What Types of Issues Does Replay QA Look For?

Replay QA looks for five categories of issues: deep runtime bugs, UI glitches, accessibility failures, performance problems, and security vulnerabilities — including scanning for injection, access control, and business logic gaps. It finds them by exploring your app like a new QA hire, writing and running tests in a Chromium browser, and capturing deterministic runtime recordings of each session. That means the issues it surfaces are ones that only appear when the app actually runs, not ones a static analyzer can catch by reading code.

The five issue categories

The security scanning is the most specific of the five. Replay QA's own description names three areas: injection flaws, access control problems, and business logic gaps. Business logic gaps are notable because they are the class of bug that static analysis and generic scanners are least equipped to find — the code can be syntactically clean and still let a user do something they shouldn't.

Why these issues specifically

The category list follows from how Replay QA works. According to the site, most QA tooling starts with flows your team defines; Replay QA instead begins by exploring the application and identifying flows worth verifying. Its three-stage process is:

1. Explore — agents map the app, discover user journeys, and work through them the way a new QA hire would in their first week.
2. Test & Record — agents write tests, run them while puppeting your app in a Chromium browser, and capture deterministic runtime recordings of every session.
3. Investigate & Report — QA agents look for bugs across the categories above and deliver reports with a root cause and a suggested fix.

Because every test runs against a live browser session, the findings are runtime findings. Replay QA's own framing of the problem makes the contrast explicit: static analysis passes on code because it reads the code without ever running the app, so defects that only surface at runtime — including the ones above — slip through.

What each bug report contains

The report format matters as much as the category list, because it determines whether you can act on a finding. Each report is prepared with coding agents in mind and includes:

• A detailed root cause analysis
• A suggested fix
• A deterministic runtime recording
• The context needed to do the job

The deterministic recording is what separates this from a screenshot-and-description bug ticket. A recording that replays identically lets whoever picks up the issue — human or agent — see the failure rather than reconstruct it.

What this means for your decision

Replay QA is aimed at teams whose shipping speed has outrun their verification. The site's own framing: a team ships 47 pull requests a week, nobody can check them all, static analysis passes on all of it, and staging looks fine because the happy path is fine — until an end user reports that checkout is broken on their phone.

If your bottleneck is that class of escaped runtime defect, the five categories above are the relevant scope. Two things to check before assuming fit:

• No existing test suite is required. The site states this explicitly, along with no credit card for the trial. If you have no tests today, that is not a blocker.
• Setup is framed as fast. The site claims you can connect a GitHub repo in 5 minutes or less, and that it runs where your team already works.

For pricing and plan limits, check the pricing page directly — the available material does not state current prices or what the trial includes beyond the no-credit-card note.