Reference
Limits and security
What the runner can and cannot do, and how it is isolated.
All documentation
Runner limits
| Limit | Value |
|---|---|
| Browser | Chromium on Cloudflare Browser Run. No Firefox, WebKit or real devices. |
| Steps per test | 100 |
| Step timeout | default 10 s, at most 30 s |
| Run timeout | default 120 s, at most 300 s |
| Screenshots per run | 20, plus the failure screenshot |
| Pages per crawl | 100 at most, lower on smaller plans |
| Viewport | 320 to 1920 px wide, up to 2160 px tall |
| Definition size | 100 KB |
Not supported: file uploads and downloads, several tabs (a page that opens a new tab has it closed, and the test continues in the first), browser extensions, geolocation and camera permissions, and custom scripts.
Network isolation
- Targets must be http or https on ports 80 or 443, with a public host name. IP addresses, localhost, private, link-local and cloud metadata addresses are refused, and DNS answers are checked before a run is accepted.
- Inside the browser, Cloudflare Browser Run guardrails block every request, including scripts, images, frames and redirects, to hosts outside the environment and the project's third party hosts. The page cannot turn this off.
- Each run gets a new browser context. Cookies, storage and cache are never shared between runs or workspaces. Downloads, service workers and permissions are disabled.
- Residual risk: a public host you allow could itself redirect or proxy to something else. Only allow hosts you trust.
Data
- Run results, logs, screenshots and traces are deleted automatically after the plan's retention period (7 days on Free, 30 on Pro, 90 on Team). Visual baselines are kept until you delete them or the test.
- Network logs keep method, URL without the query string, status and type. Response bodies are never stored. Console messages are capped in length and secret values are masked.
- Screenshots and traces are stored in a private bucket and served only to members of the workspace.
More detail is on the security page.