A browser pass is not a security review

A browser test can establish that a user completed a described action and reached an expected result. It doesn't establish that the implementation is secure.

The login form works, and the test passes. That same form might also accept a password reset for any account if you change one field in the request. No browser test written from the requirements would find that, because nobody asked it to look.

This matters more when a coding agent produces both the change and its tests, since both can reflect the same incomplete understanding of the requirement. Keep an independent review of the expected behavior, and use code review and security testing for security-sensitive changes.

You can still get something useful from browser tests here. Some authorization checks are visible, like a viewer account that shouldn't see the billing page. Make those assertions specific: the intended record, value or page state should be observable. Avoid accepting "the flow completed" as proof of every property the feature needs.

Zerocheck helps with functional browser testing, and it stops there. It doesn't do vulnerability scanning, penetration testing or security certification. Treat a passing result as evidence for the test that ran, with its explicit scope. That makes it useful without asking it to prove something it never tested.