August 2026 Summaries

Cypress Test Replay now automatically redacts sensitive authorization and credential-like values from captured network logs locally before data is uploaded to Cypress Cloud, addressing security concerns that may have previously led teams to disable the feature. Redaction is enabled by default, can be disabled per project, and replaces protected values with “(redacted)” while preserving request timing, status codes, and surrounding request structure for CI debugging. Test Replay data remains visible to all users with project access, with private-project access limited by organization roles and public-project data accessible to any Cloud user. Cypress says the feature was developed from customer feedback and invites users to report additional values that should be redacted.

Cypress’s Ambassador Spotlight features Sehani Chathurangi, a Senior Software Quality Assurance Engineer, CypressConf speaker, and blogger who shares practical test automation guidance through articles, talks, and community discussions. Inspired by other ambassadors and by Cypress’s impact on her career, she joined the program to reach a broader audience, encourage adoption of modern testing practices, and contribute to the automation community. Chathurangi values Cypress custom commands for making reusable test logic cleaner and more maintainable, and recommends data-* attributes as stable selectors that are less vulnerable to UI changes than CSS selectors or XPath. She highlights her progression from QA Engineer to Senior QA Engineer, including work with automation and serverless environments, as well as her ambassador and conference-speaking roles, while advising new users to begin with official documentation, a simple hands-on test, and the Cypress Discord community.

Cypress Cloud has introduced the Run Completion API for all plans, enabling teams to finalize test runs immediately once recording ends rather than waiting through the configured Run Completion Delay for additional test groups. Cypress Cloud commonly consolidates groups running across different machines, browsers, test types, operating systems, and environments into one run, supporting unified results, failure triage, accessibility reporting, and UI Coverage metrics. While the existing delay, which defaults to 60 seconds, helps accommodate staggered CI jobs without affecting CI idle time, a long delay can postpone terminal pass/fail status, reports, notifications, and integrations. The new API preserves the flexibility of a longer buffer while allowing teams to explicitly close a run when all expected tests are complete, improving the speed of post-run workflows such as accessibility and coverage reports, Slack or Teams alerts, desktop notifications, and CLI or MCP data access. It can be called through Cypress’s after:run configuration hook with an expected group count or invoked after required CI jobs finish without specifying a count.

Cypress has introduced cypress tap, a free beta CLI feature for Cypress 15.21.0 and later that enables AI coding agents to interact with an already running Cypress open session from the terminal. It allows agents to run specs, check execution status and reporter output, pin failure snapshots, and inspect the live application’s DOM and ARIA tree, helping them verify and correct tests rather than relying only on source-code assumptions. The tool supports both debugging failed tests, such as locating an incorrect selector, and authoring tests based on the application’s current rendered state. Cypress positions cypress tap as the local authoring and verification component alongside its Cloud CLI, which can identify and investigate failures recorded in CI; together, they enable agents to move from CI failure triage to locally tested fixes. Users can begin by updating Cypress, launching it in open mode, and adding instructions for agents to use cypress tap during test-writing workflows.

Cypress’s Ambassador Spotlight profiles Josué Lobo, a newly appointed ambassador and Senior QA Engineer who credits Cypress as the first testing tool he used and considers joining the program an important career milestone. Lobo supports the testing community through LinkedIn and YouTube content featuring Cypress tutorials, tips, and automation best practices. He highlights Cy.prompt as his favorite Cypress feature because it can translate natural-language testing steps into Cypress commands, and he recommends custom commands for reusable, application-specific behavior across tests. Outside work, he trains in Brazilian Jiu-Jitsu and kickboxing and hopes to compete in mixed martial arts, while advising new Cypress users to build practical experience by testing an open-source project.

Cypress reported that a zero-day vulnerability in its Metabase Cloud analytics instance was exploited on July 31, 2026, allowing an attacker to query a subset of data, including limited business and account information, repository and build metadata, and in some cases tokens or test data. Metabase notified Cypress on August 6, Cypress informed affected organizations on August 7, and the company says it found no evidence of continuing unauthorized access after Metabase patched the flaw, blocked the access method, and invalidated sessions. Cypress rotated affected database credentials and keys, revoked Cypress Cloud GitHub OAuth authorizations as a precaution, audited logs, and hired an independent forensic firm to review the incident. Cypress Cloud test execution and results, record keys, account passwords, payment information, and application code were not affected, while impacted customers were contacted directly. Users are advised to rotate any secrets included in build parameters or recorded test data, replace hardcoded long-lived version-control tokens, review repository access logs from July 31 onward, and remain alert to phishing attempts.

In the Cypress Ambassador Spotlight series, Peter Souza is highlighted for his contributions to the Cypress community since 2025, showcasing his passion for test automation and software quality. Peter appreciates Cypress for its user-friendly nature, which aids in enhancing product reliability and is accessible to both novices and seasoned professionals. He values pair programming as a method to assist others in using Cypress and favors the 'cy.intercept' feature for its utility in managing API interactions and modifying UI behavior. Test isolation stands out for him as the best practice, emphasizing the importance of setup over teardown in testing processes. Beyond his professional endeavors, Peter enjoys coding in React.js, playing music, and outdoor activities, and he takes pride in advancing to a management role by building trust and skills in his field. For beginners, he recommends starting with form submissions to familiarize themselves with Cypress, encouraging experimentation and skill development. His favorite quote, "A journey of a thousand miles begins with a single step," reflects his approach to both professional and personal growth.