Qualflare changelog

Qualflare now does more to protect your account from someone who gets into a signed-in session or learns your password. Sensitive changes need fresh proof that it's you, every security email lets you lock your account in one click, and managing your second factors is easier.

What's new

• "Confirm it's you." Before a sensitive change, such as adding a second factor, linking a Google or GitHub sign-in, creating an access token, changing SSO settings or changing an owner, Qualflare asks you to confirm with your password, an authenticator code or a passkey. You're only asked if you haven't proved it's you in the last five minutes. SSO and Google accounts confirm through their sign-in provider.
• "This wasn't me." Security notice emails, sent for example when your password changes, a second factor is added or removed, an access token is created, or someone signs in from a network you haven't used in 30 days, now include a This wasn't me: lock my account button. It signs out every session and revokes all your personal access tokens. The link works once and expires after seven days.
• Named passkeys. Name a passkey when you add it, rename it later, and see when each one was added and last used.
• Recovery codes, clearly. The two-factor page lists every factor and how many recovery codes are left, and warns you when you're down to three. Accounts that only use passkeys now get recovery codes too.
• Lost your authenticator? Replace it with a recovery code. Recovery codes can no longer be used to turn two-factor authentication off.

Availability

On every Qualflare plan.

If your tests already write Allure results, you can now send them to Qualflare unchanged. qf 0.4.0 reads an allure-results directory directly, so every framework with an Allure 2 adapter works with Qualflare, with no converter and no new reporter.

What's new

• Detected automatically. qf recognizes Allure output by what's inside the directory, not by its name. A single *-result.json file works too.
• Retries and flaky tests. Results that share an Allure history ID become attempts on one test. A test that failed and then passed, or that Allure marked flaky, is flagged as flaky.
• Your structure kept. Suites follow Allure's parent suite, suite and sub-suite. Labels, tags, links and nested steps come through, and Allure severities map to Qualflare's (blocker and critical become critical, trivial becomes info).
• Attachments. Screenshots, videos and Playwright traces upload as artifacts. Other files up to 1 MiB are attached directly.
• Parameters handled with care. Parameters marked hidden in Allure are dropped, and masked ones keep their name but not their value.

How to use it

pytest --alluredir=allure-results
qf myapp collect allure-results/

Availability

Requires qf 0.4.0 or newer. Upgrade with brew upgrade qualflare/tap/qf or npm install -g @qualflare/cli.

Importing test cases into Qualflare no longer ties up your browser. Once your file uploads, Qualflare queues the import and carries on in the background. Close the dialog, keep working, and you'll be told when it's done.

What's new

• Queued imports. After upload you'll see Import queued — we'll notify you and the project when it's done. Then the dialog closes itself. Large imports from TestRail, Qase, Testmo or Allure TestOps no longer depend on keeping the page open.
• Notified when it's finished. Everyone in the project gets an in-app notification: Import finished with how many cases and suites were created and skipped, or Import failed with the reason. Clicking it opens the project's test cases.
• An email too. Project members also get an email when an import completes or fails. If it fails, the email confirms that nothing from the file was added.
• Choose your emails. Project Settings → Notifications has a new Import finished setting, on by default.

How to use it

Open the ⋮ menu on the Browse page, choose Import, pick your source and upload the file. Files can be up to 20 MB.

Qualflare now supports Flutter. Upload your unit, widget and integration test results with the qf CLI and they show up as Flutter launches. The new qualflare_flutter package adds steps, screenshots and labels from inside your tests.

What's new

• Flutter results in qf. qf 0.2.0 reads the JSON output of flutter test, detects it automatically, keeps each retry attempt, and shows real messages for widget-test failures.
• The qualflare_flutter package. Mark up your tests with labels, links, tags, priority, steps and attachments. Take a screenshot with qualflare.screenshot(tester, name), or set native: true for a platform capture on a device. Use qualflareTestWidgets to attach a failure.png automatically when a test throws.
• A Flutter test type. Flutter launches show as their own test type in Qualflare.

How to use it

flutter test --file-reporter json:flutter-results.json
qf myapp collect flutter-results.json

For integration tests on a device, add --platform android or --platform ios to the qf command. To use the package, run flutter pub add --dev qualflare_flutter.

Availability

Plain Flutter results need qf 0.2.0 or newer; the qualflare_flutter package needs qf 0.3.0 and Flutter 3.24 or newer. Attachments are capped at 5 MiB each and 20 MiB per test.

Qualflare now has native reporters for WebdriverIO and for Appium suites run through WebdriverIO. They record what JUnit output can't: each retry attempt with its own error, the screenshots taken during it, and the exact browser or device the test ran on.

What's new

• Every attempt, separately. With Mocha retries, each attempt keeps its own error, start time and duration. A test that passed on a retry is marked flaky.
• Screenshots in the right place. Screenshots you take, whole-page or of an element, are attached to the test and the attempt that took them, including ones from afterTest hooks.
• Browser and device details. Platform (web, iOS, Android or desktop), device, OS version, browser and browser version are recorded for each test. Chrome and Firefox runs keep separate histories.
• Steps and metadata. Add nested steps, labels, links, tags and priority from your tests with qualflare.* helpers.
• WebdriverIO and Appium test types. Launches show as WebdriverIO or Appium in Qualflare, each with its own icon.

How to use it

npm install --save-dev @qualflare/webdriverio   # or @qualflare/appium

Add ['@qualflare/webdriverio', { environment: 'staging' }] (or @qualflare/appium) to reporters in your WebdriverIO config, run your tests, then upload the results:

qf my-project collect ./qualflare-results

Availability

Requires WebdriverIO 8 or 9, and qf 0.1.37 or newer so launches are labeled correctly. Cucumber with WebdriverIO isn't supported yet. For Appium suites written in Java or Python, use the TestNG, JUnit 5 or pytest reporters.

The smaller improvements that shipped in Qualflare in September 2026.

See what happened to every integration delivery

A project's Integrations page now has a Recent deliveries table, showing what happened each time a rule fired: when it ran, the integration and event, and whether it was Delivered, Failed (and may still retry) or Dropped. A red badge counts deliveries that didn't go through.

Integration events that now fire

Flaky Test Detected now fires once, when a test is first flagged as flaky. Before, it could be selected but never sent. Defect Resolved is now sent too. You can also turn a workspace integration on or off, or remove it, straight from its card.

Spot tests that stopped running

An automated test case that hasn't run for 30 days or more now shows a badge with how long it's been, a hint that it may have been renamed or removed. The Browse page has a matching Not run in 30+ days filter.

Trends for every test case and suite

• Each test case shows a Duration Trend chart and a daily activity grid, alongside its total runs, pass rate and average duration over 90 days.
• Suites show an Activity grid colored against your success-rate target, next to a run trend.
• Project and workspace cards show a 30-day launch grid.

Safer sharded uploads with qf

• Leftover files are ignored. When a results folder holds files from more than one run, qf uploads only the newest run and tells you which files it skipped. Pass --allow-mixed-runs to include them (0.1.21).
• Attachments upload separately. One large attachment can no longer fail a whole sharded launch (0.1.22).
• Videos and traces are opt-in. Screenshots still upload by default. Add --upload-artifacts=video,trace to include videos and traces (0.1.20 and 0.1.24). This is a change from earlier versions, which uploaded videos automatically.

Smaller fixes

• The project's AI switch now turns off every AI feature in that project, not only the chat.
• Flaky scores in AI Insights show their real percentage.
• A brief network hiccup while refreshing your session no longer signs you out.

More of Qualflare's AI is now available on the free and entry plans. Teams on Starter and Open Source get AI analysis of their test runs and flaky test detection, which used to need a paid plan.

What's new on Starter and Open Source

• AI launch analysis. Each launch gets an AI summary of what failed and why: 10 analyses a month on Starter, 100 a month on Open Source.
• Root-cause analysis and automatic defects. Qualflare can suggest likely causes for failures and create defects from them automatically.
• Flaky test detection. Tests that pass and fail without code changes are flagged as flaky.
• Failure clustering on Starter. Similar failures are grouped into clusters, up to 2 at a time on Starter. Clustering is not part of the Open Source plan.

See your allowances

Plan & Billing now shows a Launch Analysis allowance next to your other AI quotas, and warns you when any AI allowance is running low. When the month's launch analyses are used up, AI analysis for new launches is marked as unavailable until the allowance resets.

Availability

Core, Scale and Enterprise plans already included these features, with no monthly launch-analysis cap. AI Insights (test suite optimization) is not included on Starter or Open Source.

Qualflare's native reporters now cover Java and mobile testing. JVM and Android teams get the same steps, retries and screenshots in Qualflare as JavaScript and Python teams, and iOS teams get attachments without installing anything new.

What's new

• JUnit 5: com.qualflare:qualflare-junit5. Add the dependency and it registers itself. It records Surefire reruns as retries, and also reports JUnit 4 tests run through junit-vintage. Requires JUnit Platform 1.12+ and Java 11+.
• TestNG: com.qualflare:qualflare-testng. Add the dependency only. Records IRetryAnalyzer retries, gives timeouts and configuration failures their own status, and reports each DataProvider row as its own case. Requires TestNG 7.4+.
• Espresso: com.qualflare:qualflare-espresso. Add it as an androidTestImplementation dependency and set the run listener. It captures steps, retries, timeouts and screenshots, taken automatically on failure with QualflareRule. Upload straight from the build output, with no adb pull needed.
• Detox: npm i -D @qualflare/detox. Add it as a Jest reporter, then run qf my-project collect ./qualflare-results --artifacts-dir ./artifacts to attach Detox's screenshots, videos and device logs to the right tests.
• XCTest attachments. qf 0.1.31 reads attachments and retry history straight from your .xcresult bundle, with no iOS reporter needed.

Availability

Every reporter works on every Qualflare plan. Detox artifacts need qf 0.1.32 or newer. Screenshots upload by default; add --upload-artifacts=video,trace to include videos.

Qualflare now connects to Notion. If your team plans and tracks work in Notion, test failures can land there automatically as formatted pages in a database you choose.

What's new

• Pages in your database. For each event you select, Qualflare creates a page (a row) in the Notion database you choose, with the details formatted for reading.
• Pick your events. Create pages for Defect Created, Launch Failed, Cluster Created or Flaky Test Detected.
• Linked from the defect. The Notion page appears under Linked issues on the defect page.
• Clean disconnect. Disconnecting Notion revokes Qualflare's access in Notion, too.

How to connect it

1. A workspace admin connects Notion under Workspace → Integrations.
2. In Notion, share the database with Qualflare from the database's Connections menu.
3. In each project, go to Project → Integrations → Notion and paste the database's URL or ID.

Qualflare now has an MCP (Model Context Protocol) server. Point Claude Code, Cursor or any MCP-compatible coding agent at it, and the agent can look up your test results, failure clusters and defects while it works on your code. It can also create and update test cases, steps and defects for you.

What's new

• One endpoint. https://api.qualflare.com/mcp, authenticated with a project access token: the same kind of token the qf CLI uses.
• Read tools. 16 tools let an agent list and read launches, failure clusters, defects, test suites, test cases and their steps, test plans and milestones. For example, it can find out why last night's run failed before it starts on a fix.
• Write tools. Agents can create and update test cases, case steps and defects. Nothing can be deleted.
• Your role, your limits. A token can do what its creator's project role allows: a Viewer's token can read, and an Editor's can also create and update. Since October 2026, a token also needs Allow writes turned on when it's created before it can make changes.
• Matching REST API. The public API gained the same create and update endpoints for cases, steps and defects.

How to connect

Create or copy a token under Project Settings → Access Tokens. The Connect a coding agent panel there has ready-made setup for Claude Code and for Cursor & others. For Claude Code:

claude mcp add --transport http qualflare https://api.qualflare.com/mcp --header "Authorization: Bearer YOUR_TOKEN"

Availability

Available on every Qualflare plan. Test cases created through MCP count toward your plan's test case limit.

Maestro results used to reach Qualflare as JUnit XML — one line per flow, with a status, a duration and a failure message. Everything Maestro actually did was left on the CI worker. qualflare-maestro changes that: it wraps maestro test, reads what Maestro leaves behind, and reports a step for every command, named from your flow's own YAML.

brew install qualflare/tap/qualflare-maestro
qualflare-maestro -- maestro test .maestro/
qf my-project collect ./qualflare-results

Maestro's exit code passes through unchanged, so the command drops into CI in place of maestro test.

What lands in a report that JUnit XML could not carry:

• A step per command, nested under runFlow, repeat and retry on Maestro 2.10+. An optional command that did not succeed becomes a skipped step.
• Maestro's own screenshots, attached to the step that took them.
• Tags and metadata read from the flow file, including qualflare.* properties.
• Runs that died before Maestro wrote anything — invalid YAML, no device — which previously produced no file at all, and so no launch.

Values passed with --env and MAESTRO_* environment variables are replaced with ${NAME} in report text, so values handed to a flow that way are not carried along with its results. The reporter makes no network calls of its own, and it works with both of Maestro's debug-output layouts (2.6.x and 2.10+).

It needs Maestro 2.6.0 or newer, and qf 0.1.24 or newer for screenshots. Full setup is on the Maestro test reporting page, and the limitations are listed in the repository.

Qualflare now posts to Microsoft Teams. Choose a channel per project and your team sees failed launches, new defects and flaky tests where they already talk, as cards they can act on.

What's new

• Built on Teams Workflows. Qualflare connects through a Workflows webhook, which replaces the Office 365 connectors Microsoft retired on 30 April 2026.
• A channel per project. Connect as many channels as you need, then pick one for each project rule.
• Every event available. Choose from Launch Completed, Launch Failed, Defect Created, Defect Resolved, Cluster Created, Milestone Completed and Flaky Test Detected.
• Verified on connect. When you add a channel, Qualflare posts a verification message to it, so you know it works.

How to connect it

1. In Teams, open the channel and choose ⋯ → Workflows, then Post to a channel when a webhook request is received, and copy the webhook URL.
2. In Qualflare, go to Workspace → Integrations → Microsoft Teams → Channels, paste the URL, give it a name, and click Connect channel.
3. In each project, add a rule under Project → Integrations → Microsoft Teams, then choose the channel and events.

The project Overview in Qualflare has been rebuilt to answer three questions at a glance: can a green run be trusted, is testing slowing the pipeline down, and is quality improving?

What's new

• A KPI strip. Six tiles open the dashboard: Success Rate, Flake Rate, Launch p90, Automation, Defects Opened and Launches. Each shows the change vs. previous period and a sparkline.
• Charts grouped by question.
  • Reliability: case runs, flakiness, retry burden, and the new Success Rate by Environment, with one line per environment.
  • Performance: launch and case durations as P50/P90/P99 bands, plus launch throughput.
  • Quality: automation, defects opened and closed, defects by severity, and the new Defects by Category.
• Quality targets. Set a target success rate, flake rate, automation rate and launch p90 duration for each project. KPI values turn green or red against them, and dashed target lines appear on the Flakiness and Launch Durations charts.
• Data freshness. A label shows when the trends were last updated, and warns if the data is older than expected.

How to set targets

Go to Project Settings → Quality → Quality Targets. Leave a field empty, or set it to 0, for no target. Target changes are recorded in the audit log.

Qualflare now connects to Linear. Test failures that need a fix become Linear issues in the team that owns them, with labels and a priority already set, and you can see each issue from the defect it came from.

What's new

• Connect with one click. Linear connects through its own sign-in, and asks only to read your workspace and create issues. Issues are created by the Qualflare app, not in the name of the person who connected it.
• Issues with context. Each issue lists the defect's details, such as environment, category, and expected versus actual results.
• Team, labels and priority. Choose a Linear team and labels for each project. Qualflare also adds a label for the test environment, and maps defect severity to Linear priority (critical → Urgent, high → High, medium → Medium, low → Low).
• Linked issues on defects. The Linear issue appears under Linked issues on the defect page, for example "Linear ENG-12".
• Pick your events. Create issues for Defect Created, Launch Failed, Cluster Created or Flaky Test Detected.

How to connect it

A workspace admin connects Linear under Workspace → Integrations. Each project then chooses its team, labels and events under Project → Integrations → Linear.

Qualflare's Jira integration is now an app on the Atlassian Marketplace: Qualflare Test Management for Jira. It creates Jira issues from your Qualflare defects, failed launches and flaky tests. It acts as itself with its own limited permissions instead of a teammate's API token, so it keeps working after that person leaves.

What's new

• A Marketplace app. Install it from the Atlassian Marketplace. The app asks only to read and create Jira issues.
• Issues created automatically. For each project, choose which events create an issue (Defect Created, Launch Failed, Cluster Created or Flaky Test Detected) and set the Jira project, issue type and labels.
• Priority from severity. Leave Priority on Auto (from severity), or map each Qualflare severity to a Jira priority yourself.
• Linked issues on defects. The Jira issue Qualflare creates appears under Linked issues on the defect page.

How to connect it

A workspace admin opens Workspace → Integrations → Jira → Install and installs the app from the Marketplace. Each project then adds its own rule under Project → Integrations → Jira. Since October 2026, Qualflare also gives you a one-time pairing code to enter in Jira, which links the right workspace to your Jira site.

Upgrading from the old Jira integration

The token-based Jira integration has been replaced. If you used it, its card shows Reconnect required — your project settings are kept: install the app, and your existing project rules carry on working.

Qualflare now integrates with PagerDuty. When a launch fails or a serious defect is reported, Qualflare opens an incident on the right PagerDuty service, and closes it again when the problem clears.

What's new

• Installed from PagerDuty. Connect through PagerDuty's own app install instead of pasting a routing key, and choose the services Qualflare may page.
• Different services per project. One install can cover several PagerDuty services, and each project rule chooses which one to page, so each team gets its own alerts.
• Severity that makes sense. Leave severity on Automatic and Qualflare decides:
  • defects use the defect's priority
  • failed launches are tiered by how much broke
  • failure clusters are warnings
  • recoveries are informational, which never pages
• Incidents that resolve themselves. Defect Resolved and Launch Completed close the incident opened by their failing counterpart. Launch incidents are tracked per project and branch.
• Pick your events. Choose from Defect Created, Defect Resolved, Launch Completed, Launch Failed, Cluster Created and Milestone Completed.

How to connect it

A workspace admin installs PagerDuty under Workspace → Integrations. Each project then adds a rule under Project → Integrations → PagerDuty. Select events in pairs, such as Launch Failed with Launch Completed, so incidents close automatically.

Qualflare now has native reporters for eight popular test frameworks. JUnit XML records little more than pass or fail and a message. A native reporter also records the steps that ran, every retry attempt, screenshots and metadata, so a failure in Qualflare looks the way it did on your machine.

The reporters

Framework	Install	Highlights
Playwright	npm i -D @qualflare/playwright	Nested test.step() steps, retries and flaky tests, screenshots, videos, automatic shard numbers
Cypress	npm i -D @qualflare/cypress	Command steps, per-attempt retries, automatic failure screenshots, videos
Jest	npm i -D @qualflare/jest	Nested steps, retries, attachments, metadata (Jest 29+)
Vitest	npm i -D @qualflare/vitest	Assertion diffs, nested steps, retries, shards (Vitest 3+)
Mocha	npm i -D @qualflare/mocha	Nested steps, retries, attachments
CucumberJS	npm i -D @qualflare/cucumberjs	Given/When/Then steps, Scenario Outline rows, screenshots
pytest	pip install qualflare-pytest	Steps, reruns, attachments, pytest-xdist workers recorded as shards
Go	go install github.com/Qualflare/qualflare-go/cmd/qualflare-go@latest	Subtests as their own cases, nested steps; wraps go test -json

How it works

Each reporter writes its results to a ./qualflare-results folder and makes no network calls of its own. Upload the folder with the qf CLI:

qf my-project collect ./qualflare-results

Sharded runs can write into the same folder, and qf merges them into one launch.

Availability

The reporters are open source and work on every Qualflare plan. Use qf 0.1.24 or newer to upload screenshots. Each framework's page in the docs has setup instructions.

Qualflare workspace owners can now require two-factor authentication for every member. Turn on one switch and the whole workspace signs in with a second factor: an authenticator app or a passkey.

What's new

• A workspace-wide policy. The new Authentication page in workspace administration has a Require two-factor authentication switch.
• Members are guided to set it up. Members who haven't set up a second factor are asked to do so the next time they sign in.
• A safe default. The setting is off for new workspaces, and an owner can only turn it on after setting up two-factor authentication on their own account.

How to turn it on

A workspace owner opens Administration → Authentication and turns on Require two-factor authentication. If you haven't set up a second factor yourself, the page links you to do that first.

Update: October 2026

Since October 17, 2026, turning the policy on also immediately signs out members who don't have a second factor and revokes their access tokens. While the policy is on, members can't remove their only second factor.

Availability

Available on every Qualflare plan. Only workspace owners can change the setting.

Qualflare now supports CTRF, the Common Test Report Format: an open JSON format that many test frameworks and CI tools can produce. Any tool that writes CTRF can now send its results to Qualflare, and any Qualflare launch can be exported back as CTRF.

What's new

• Upload CTRF with qf. qf <project> collect results.json recognizes CTRF files automatically, in both the current and the older layout.
• Upload CTRF with the API. Send a report to POST /api/v1/collect/ctrf with your project access token, no CLI needed.
• Export a launch as CTRF. GET /api/v1/launch/{launchSeq}/ctrf returns the whole launch as a CTRF report, so you can feed your results into other tools.
• Seven statuses, nothing lost. Qualflare keeps all seven test statuses (passed, failed, skipped, error, timeout, aborted and pending) instead of merging timeout and aborted into failed or error. On export these appear as failed, with the exact status in rawStatus, so uploading the export again restores them.
• Retries count toward flakiness. CTRF retry attempts become per-attempt history, which Qualflare uses to detect flaky tests.

Availability

Requires qf 0.1.19 or newer for CLI uploads. CTRF upload and export work on every plan. Exports are limited to launches with fewer than 20,000 case results.

The smaller improvements that shipped in Qualflare in August 2026.

Import test cases from Allure TestOps

The Import Test Cases dialog has a new Allure TestOps option for CSV exports. Suites are built from the export's labels, and nested sub-steps keep their indentation.

Choose whether your workspace helps improve Qualflare AI

Under Workspace → Settings, the Help improve Qualflare AI switch controls whether Qualflare keeps anonymous records of AI requests. Credentials and email addresses are always removed first. Workspace managers can turn it off at any time, and new records stop within about five minutes.

Help without leaving the app

When you're signed in, you can chat with the Qualflare team from the support messenger inside the app.

Find any page faster

A Search… button in the toolbar opens the command palette, which you can also open with Shift + /. It now lists every project and workspace page, with a short description of each, grouped like the sidebar.

A trend chart for failure clusters

On Failure Clusters, a 30-day chart shows failures collected per day alongside the total number of clusters, replacing the bubble chart.

Turn off your own email notifications

Project Settings → Notifications now has a Your Email Notifications section. It applies only to you, so you can mute a project's emails without affecting your teammates. If you unsubscribe from an email by mistake, you can turn notifications back on in the app.

Steps from more frameworks

• qf 0.1.14 turns each Newman assertion into a step.
• It reads Xcode .xcresult bundles directly, including XCTest activity steps.
• It records the browser and platform on a launch when all suites agree.
• qf 0.1.16 brings Playwright test.step() steps into Qualflare.
• qf collect also accepts a whole directory of result files.

Framework test types

Cypress, JUnit, Cucumber and other frameworks now show as their own test type, with the framework's logo, and test cases inherit their suite's type.

Account security updates

• New and changed passwords must be at least 14 characters.
• Accounts unused for 45 days get a warning email, and are deactivated after 60 days. A deactivated account can be restored.

Accept the DPA online

You can now accept Qualflare's Data Processing Agreement yourself at qualflare.com/dpa, with a confirmation sent by email.

A failed test in Qualflare now comes with the context you need to understand it: the steps that ran, the screenshots it captured, and the CI build it came from, all on the case run itself.

What's new

• Steps on every run. A case run shows the steps that actually executed: nested, with each step's status, duration and error, and its parameters when you expand it.
• Attachments. Screenshots appear as thumbnails you can preview and download. A new Attachments tab on each launch collects them across the whole run.
• Labels and links. Labels from your test framework are shown, along with links to issues and test-management items.
• CI details on the launch. The launch header shows the CI provider, build number, pull request number and a View CI Run link. Suite runs show browser and OS separately.
• Additional properties. Extra metadata your reporter sends, such as security-scan details or browser and platform, appears in an Additional Properties table.
• History for each step. On a test case's Steps tab, View run history lists every run of that step, with its status and duration. A badge tells you whether a step was generated by Quo or synced from an automated run.

How to get it

Most of this comes from what your test framework reports. Qualflare's native reporters and the qf CLI send steps, attachments, labels and CI details automatically.

Availability

Available on every Qualflare plan.

Our Shared Security Responsibility Model page now states explicitly how we keep it current: we review it at least annually, and immediately after any change material enough to shift what's described there. From now on, any change to that page's ownership split gets an entry here under Security — this entry is the first one.

We've also made the invitation to give feedback on that page explicit — if anything on it doesn't match what you're seeing, or you think a responsibility should be split differently for your use case, email support@qualflare.com. That's always been true in practice; now it's said plainly.

Public test reports for open-source projects now have a home of their own at reports.qualflare.com. They load fast for visitors, look good wherever you share them, and can show your project's test health right in your README.

What's new

• A dedicated reports site. Each published project has a page listing its recent runs, with branch, commit, duration and status, plus its pass rate and last run. Each run opens to show totals for passed, failing, flaky and retried tests, and a breakdown by test suite. Older report links redirect automatically.
• Rich link previews. Sharing a report link in Slack, X or a pull request shows a preview card with live numbers, such as pass rate, run count and last run date.
• A README banner. Next to the existing badge, a wider banner shows your repository name, pass rate, number of runs, a flaky-test summary and a strip of recent runs. Copy its Markdown from project settings.

How to publish

Go to Project Settings → General → Public report, turn it on, and type the project's slug to confirm with Publish Report. Turning it off unpublishes the report straight away, and runs from before that stay hidden even if you publish again.

Availability

Publishing public reports is part of the free Open Source plan.

Qualflare now understands sharded test runs. Upload the result files from all your shards together and they become a single launch. The new Shards tab then shows how the work was spread across shards, so you can see which shard is slowing the build down.

What's new

• --shard for qf collect. Pass every shard's result file to one qf collect call with --shard, and each file becomes its own shard, numbered from 0 in the order you list them.
• Shards detected automatically. Playwright JSON reports use each test's worker as its shard, and record when each test started. JUnit and pytest reports can set a shard per test with a shard property. You don't need a flag for either.
• The Shards tab. On a launch, Shards shows a Shard Timeline: one row per shard with its case count and duration. Where start times weren't reported, the timeline estimates them from case order and draws them dashed.

How to use it

Collect every shard's results in the same job (for example, download them as artifacts from each shard job), then upload them together:

qf my-app collect shard-0.xml shard-1.xml shard-2.xml --shard

List the files explicitly to keep shard numbers stable. A glob sorts by filename, so shard-10 comes before shard-2.

Availability

Requires qf 0.1.13 or newer. The Shards tab works on every plan.

In Qualflare, details now open in a floating panel beside the list you're working in, instead of on a separate page. Check a case, a launch or a defect, then carry on where you were.

What's new

• One panel for everything. Suites, cases, launches, suite runs, case runs, defects, milestones and shared steps all open in the same panel.
• Keep working behind it. The page behind stays usable: nothing is dimmed, and clicking outside the panel doesn't close it.
• Make it as wide as you need. Drag the panel's left edge to resize it, or focus the edge and use the arrow keys. Qualflare remembers your width.
• Drill down and come back. Opening something from inside the panel stacks it on top. Your browser's Back button returns to the previous one, and Escape or the close button closes the panel. Each panel has its own URL you can share.
• Expand suites in place. On the Browse page, expand a suite to see its cases without leaving the list, drag cases to reorder them, and select suites and cases together for bulk actions.

Availability

Available to every Qualflare workspace.

Quo, Qualflare's AI agent, no longer changes your test suite on its own. Whenever it proposes a change, it shows you exactly what it will do and waits for your approval. Nothing is written until you say so.

What's new

• Approval for every change. Quo asks first before it creates test cases, writes a case's steps or attaches a coverage score to a suite.
• A clear summary. The request names the change, for example Create cases or Update steps, describes exactly what will happen, and confirms that nothing has changed yet.
• Approvals expire. An approval is valid for 15 minutes. After that, ask Quo again, so an old suggestion can't be applied by accident.
• Every decision is recorded. Approved changes show as Applied and declined ones as Cancelled — nothing was changed, and they stay that way after a page refresh.

How it works today

At launch you approved with Confirm or Cancel buttons on a confirmation card. Since October 2026 you reply in the chat instead. The rule is unchanged: Quo makes no change without your approval.

Availability

On every plan that includes Quo: Starter, Core, Scale and Enterprise.

Qualflare Enterprise workspaces can now connect a SAML 2.0 identity provider such as Okta, Microsoft Entra ID, Google Workspace or ADFS. Members sign in with their company credentials. SCIM 2.0 can also keep workspace membership in sync with your directory automatically.

What's new

• Single Sign-On. Upload your identity provider's SAML metadata and turn the connection on. The page shows the Entity ID, ACS URL and Name ID format to enter in your identity provider, plus the signing certificate's expiry date. You can rotate the certificate at any time.
• Verified Domains. Add a domain and publish the DNS TXT record Qualflare shows you. After that, members with an email at that domain are routed to your identity provider at sign-in.
• Role mapping. Map identity provider groups onto Viewer, Editor or Maintainer with ordered rules (the first match wins), and set a default role. Optionally, roles can be re-applied at every sign-in.
• Require SSO. Turn off password and social sign-in for the whole workspace. This is only possible once a domain is verified and at least one real SSO sign-in has succeeded, so you can't lock everyone out by accident.
• SCIM Provisioning. Generate a token, paste the SCIM base URL into Okta or Entra ID, and enable provisioning. People are added, updated and removed as your directory changes. Only addresses at verified domains can be provisioned.

Update, October 2026: since October 16, Require SSO applies only to members whose email address is at one of your verified domains. Members at other domains keep signing in with their own methods, and the Single Sign-On page shows how many members it doesn't cover. See What's new in Qualflare: October 2026.

How to set it up

The workspace owner opens Administration → Single Sign-On, then continues with Verified Domains and SCIM Provisioning. Each page explains the next step, and SCIM becomes available once a working SSO connection exists.

Availability

These features are on the Enterprise plan. On other plans, the pages describe what the feature offers instead of showing a live configuration.

You can now install Qualflare's qf CLI the way your pipeline already installs tools: from npm, as a Docker image, or through a GitHub Action that uploads your test results in one step.

What's new

• npm. npm install -g @qualflare/cli installs qf on macOS, Linux and Windows. Since 0.1.12 it installs through a package for each platform and runs no install script.
• Docker. Multi-architecture images (amd64 and arm64) at ghcr.io/qualflare/qf and docker.io/qualflare/qf, tagged by version and latest. For example: docker run --rm ghcr.io/qualflare/qf version.
• GitHub Action. Qualflare/qualflare-action@v1 downloads qf, signs in and uploads your results. You give it four inputs: token, project, results (a path or glob) and an optional version.

How to use it

- uses: Qualflare/qualflare-action@v1
  with:
    token: ${{ secrets.QUALFLARE_TOKEN }}
    project: my-app
    results: test-results/*.xml

Homebrew still works: brew install qualflare/tap/qf.

Availability

All three install methods work with every Qualflare plan. Since v1.0.3 (November 2026), the Action passes your token through an environment variable instead of the command line, and works on reused self-hosted runners.

The smaller improvements that shipped in Qualflare in July 2026.

Guided setup for new projects

A new project's Overview now shows a Set up this project card instead of a sample project. It walks you through four steps: install the CLI, save your access token, sign in with qf login, and upload your first results. The card then switches to your real dashboard on its own when the first run arrives, with no refresh needed. New projects also start with an access token and four environments: development, staging, production and qa.

A clearer sidebar

Sidebar items are now grouped under section headers: Overview, Planning, Analysis and Configuration in a project, and Management and Administration in a workspace. Insights is now AI Insights, and Clusters is now Failure Clusters.

A refreshed dark theme

Dark mode uses layered greys instead of pure black, and the sidebar and toolbars have their own shade. Status colors now meet contrast guidelines in light mode, and each run status uses the same color on every screen.

Error messages that tell you what happened

Errors now show the specific reason when there is one, and form errors appear next to the field that caused them. Server errors include a reference ID to quote to support. If your connection drops, Qualflare says you appear to be offline instead of "Something went wrong".

Stronger sign-in protection

• Sessions now end 90 days after sign-in, however active they are.
• Each authenticator code can be used only once.
• After 10 failed sign-in attempts for an email, the next attempt needs a quick human check. The account is never locked.
• Deleting a passkey now asks you to verify with a passkey or authenticator code first.

Public API: one format for every list (breaking change)

Every list endpoint in the /api/v1 public API now returns results under items with a paging block, replacing the old per-resource keys such as launches and defects. Launch and defect lists now default to newest first, and launch lists accept perPage (1–100).

If you call the API directly, update your client. The qf CLI and the web app already use the new format.

qf 0.1.9 makes the results Qualflare shows you match what actually happened in CI. A report with failures, crashes or unrecognized statuses can no longer appear as a passing launch.

What's new

• No more false greens. Across all 16 report formats qf reads:
  • A test with an unknown status now counts as an error instead of a pass.
  • Suite totals are recalculated from the individual tests, so a report with real failures can't show as green.
  • Crashes that used to drop tests are reported as failures: a Jest suite crash, RSpec errors outside examples, a failing Cucumber Background, Go tests with no final event.
• Framework-specific fixes. Interrupted Playwright runs are errors, while expected failures from test.fail() count as passed. Cypress it.skip is reported as skipped. A Newman request whose assertions were all skipped is skipped too.
• --debug logs every request and response to stderr, with your token removed, so you can see what qf sent without leaking credentials.
• --no-capture-output keeps captured stdout and stderr from pytest, PHPUnit and JUnit XML reports off Qualflare. Status, timing and failure messages are still uploaded.
• --platform and --milestone. Tag a launch as android, ios, desktop, web or api, and link it to a milestone by its number.
• Keep your token off the command line. qf login <id> now reads the token from QF_TOKEN, a hidden prompt or piped input, so it doesn't end up in shell history.

Also in this release

• Clearer exit codes for scripts: 3 for authentication, 4 for quota or permission, 5 for not found, 7 for temporary errors.
• Error messages include a request ID for support.
• A file passed twice is counted once.
• Release downloads are signed and ship with SBOMs.

How to get it

Upgrade with brew upgrade qualflare/tap/qf, or download the release from GitHub.

Qualflare now has a free Open Source plan for public GitHub projects. Link your repository and you get test reporting with no subscription, plus a public report page you can share with contributors and users.

What's new

• A free plan for open source. Open Source workspaces cost nothing and need no payment details.
• Linked to your GitHub repository. Each project is tied to a repository, and the repository is checked to confirm it qualifies.
• A public test report. Publish a read-only report of your project's launches at a shareable URL, so anyone can see your project's test health without an account.
• A README badge. Copy a Markdown badge that shows your latest run, for example "qualflare: 128 passed", and links to your public report.

Who qualifies

Your repository must be public, not a fork, not archived, and have an OSI-approved open-source license.

How to get started

When you create a workspace, choose Open Source ("Free plan for a public GitHub project, with a shareable report page"). Then link each new project to its repository from the Repository picker, after connecting GitHub. To publish the report, go to Project Settings → General → Public report.

Availability

The Open Source plan is free for eligible public repositories. Since September 2026 it also includes AI features, such as up to 100 AI report analyses a month. See the docs for current limits.

Qualflare now supports passkeys. Add Face ID, Windows Hello or a hardware security key to your account, then use it at the two-factor step when you sign in, instead of typing a code from your authenticator app.

What's new

• Passkeys. A new Passkeys page in your account settings, where you can add passkeys and remove ones you no longer use.
• Use your passkey at sign-in. When Qualflare asks for your second factor, choose Use your passkey and confirm with your device.
• Two-factor sign-in now also covers Google and GitHub. If you sign in with Continue with Google or Continue with GitHub, your second factor is still required, so your two-factor setting protects your account however you sign in.

How to set it up

Open your account settings and go to Security → Passkeys, then click Add a passkey and follow your browser's prompt.

You can still use an authenticator app under Security → Two-Factor Authentication. Setup gives you 10 single-use recovery codes. Copy or download them before you finish, because they aren't shown again.

Security → Sessions lists every browser you're signed in on, with its operating system, IP address and last activity. You can revoke a single session, or use Revoke All Other Sessions. Changing your password also signs out every other session automatically.

Availability

Passkeys and two-factor authentication are available on every Qualflare plan.

The smaller improvements that shipped across Qualflare's web app, the qf CLI and the Claude Code plugin in May 2026.

Cancel an import while it uploads

Importing test cases from Qase (CSV, JSON or XML), TestRail (CSV or XML) or Testmo (CSV) now shows upload progress as a percentage. A Cancel Upload button stops the import part-way, and if an upload fails, Try Again lets you retry without starting over. Open it from the ⋮ menu on the Browse page → Import.

Sign in once with qf login

qf 0.1.5 adds qf login <identifier> <token>, which stores a project's access token in your user config directory, readable only by you. After that you run commands by identifier, for example qf myapp cases. qf projects lists the identifiers you've set up, and qf logout removes one.

This is a breaking change: qf no longer reads QF_API_KEY. To migrate, run qf login <identifier> $QF_API_KEY once. In CI, run qf login ci "$QF_TOKEN" --force before your other commands.

Safer uploads from the CLI

qf 0.1.6 no longer retries a failed upload automatically, so a flaky network can't create a duplicate launch. It also never forwards your access token when a request is redirected to another host.

Sign in from /qf-init in Claude Code

In version 0.17 of the Qualflare plugin for Claude Code, /qf-init asked for any missing project token right in the chat and ran qf login for you.

Update, September 2026: since version 0.19, /qf-init no longer takes tokens in the chat, so a token never ends up in your session transcript. It lists one qf login <identifier> command per missing project. You run each one in your own terminal, where it asks for the token at a hidden prompt, then reply done.

Accessibility improvements

Icon-only buttons across the web app now have screen-reader labels, so assistive technology announces what each one does.

Qualflare now points out the test cases that cost you time without adding coverage. The new Insights page collects flaky, low-value and redundant cases that Qualflare finds as it analyzes your launches, and explains why each one was flagged.

What's new

• One place for suite clean-up. Tabs for Flaky, Low Value and Redundant, with each case's suite, a confidence level and when it was detected.
• Redundant cases, side by side. For a redundant case, Qualflare shows the similar case it overlaps with, a similarity score and the AI's reasoning, so you can decide whether you need both.
• Low-value scores. For a low-value case, you see the signals behind the call: overall value, failure rate, duration efficiency, freshness and total runs.
• You stay in control. Accept or Dismiss each recommendation, and filter by Active, Accepted, Declined or Stale. Qualflare never deletes or quarantines a case on its own.
• Notifications lead here. Alerts about flaky, low-value or redundant cases open Insights already filtered to that type.

How to use it

Open Insights from the project sidebar (named AI Insights since July 2026). Recommendations appear after Qualflare has analyzed some of your launches, so there's nothing to set up. AI features need to be on for the project under Project Settings → AI.

Availability

Redundant-case detection counts against your plan's monthly Case Analysis allowance. Flaky and low-value checks don't. It launched on the Scale and Enterprise plans. It is part of AI test suite optimization, which is not included on the Starter or Open Source plans.

Quo, Qualflare's AI agent, now saves your conversation on the server. Reloading the page or switching browsers no longer clears it. You can also stop Quo mid-answer when a reply is heading the wrong way.

What's new

• Your chat is saved. Each project keeps your conversation with Quo, so when you reopen the Quo Agent panel after a reload you pick up where you left off.
• Load older messages. Long conversations open at the latest messages, and Load more fetches earlier ones.
• Stop a reply. While Quo is answering, the send button turns into Stop. Clicking it, or pressing Escape in the message box, cancels the answer and keeps what you typed.
• Start fresh. The + button in the panel header starts a new chat.

How to use it

Open Quo from the toolbar in any project where AI features are on. A project admin can switch them on under Project Settings → AI → Enable AI Features.

Availability

Quo is included on the Starter, Core, Scale and Enterprise plans. The number of agent messages per day depends on your plan.