| Logs or a WAF need to recognize QA.tech traffic | Identify the bot by its User-Agent suffix | QA.tech Bot |
| A firewall, CDN, or CAPTCHA blocks the test by IP | Allowlist the outbound IPs | IP Access |
| Vercel Firewall returns a block before the app loads | Bypass remaining rules when the User-Agent contains QATechBot | Vercel Firewall |
| A Vercel preview is behind deployment protection or trusted IPs | Send the Protection Bypass for Automation secret | Vercel Preview |
| Cloudflare returns 403, 1020, or a challenge page, or a Turnstile widget stops a form | Allow the bot at the edge, or change how the app loads Turnstile | Cloudflare WAF and Turnstile |
| The preview you meant returns 403 or “Access denied” (an identity proxy, a VPN, or a hostname that is not public), while another preview on the same pull request loads | Publish a hostname QA.tech can open, or allow the bot through the proxy. When the pull request publishes several URLs, pass the one to test from the Change Review Action | Map environments to applications |
| The app is on a private network or behind a jump host | Route the browser through an SSH tunnel | SSH Tunnel |
| The app is only on your machine | Expose local ports with qatech tunnel | qatech tunnel |
