Safe to point at a live site
These limits are enforced in the code that drives the browser, not requested in a prompt.
What a run will never do
- Send a formOnly page loads go out. Submit buttons of forms that send data are never clicked, so nothing is registered, ordered or paid for. A site search works like a link.
- Type a password or card numberThose fields stay empty.
- Wander off your domainA link or redirect to another site is stopped, and the visitor is brought back to yours.
- Visit a site you do not ownA run starts only after the domain is proved yours, and never on internal addresses.
Prove the domain
A DNS TXT record, a file at a fixed address, or a meta tag on the start page. Any one is enough.
Recognise our traffic
Every request from a run carries the header X-UX-Panel: ai-test, so you can tell it apart in logs and analytics or filter it out.
Test payment mode
On a test host such as staging.example.com you can let visitors send forms and pay with Stripe test cards. Any sign of live payment keys stops the run.
What a run cannot tell you
- Notes come from a language model. Some will be wrong, so check them on the site.
- Visitors read text and controls. They do not judge the visual design.
- "Would pay" is an opinion, not a conversion forecast.
- On a live site, sign-up and payment are not tested, because forms are not sent.