VibeTest by AppDash · User Guide

Write tests in plain English. Let AI run them. See pass/fail in Jira.

VibeTest turns a Jira issue into a place to describe what to test — then runs it for real on your own Mac and streams the verdict, screenshots, and step-by-step results right back into the issue. No CI pipeline, no test code.

A complete walkthrough for new users · covers why teams choose VibeTest, creating, running, and reviewing tests, pairing your Mac, the desktop app, security, and troubleshooting.

1 Why VibeTest

Every team knows it should test more. But automated tests are expensive to write and maintain, and manual testing doesn't scale. VibeTest takes a different path: describe the test in plain English on the Jira issue, and an AI agent runs it for real — on your own machine.

No code required

Tests anyone can write

Author tests in plain English or Given / When / Then — right on the issue. Product managers, QA, and analysts write tests without waiting on engineers or learning a framework.

Native to Jira

Tests live where the work lives

Tests attach to the Jira issue they verify — not a separate tool. Requirement, test, and result sit together, so traceability is automatic and nothing drifts out of sync.

AI-driven

An AI agent does the running

The agent reads your scenario and drives the real app, adapting to the screen in front of it instead of replaying brittle, hand-recorded selectors that break on every redesign.

Private by design

It runs on your machine

Execution happens on your Mac, with your AI agent. Your source code, logins, internal sites, and test runs never leave your laptop — Jira only ever receives the result.

How it compares

VibeTest sits between the worlds of manual QA and heavyweight test automation — and sidesteps the usual trade-offs of each.

ApproachWho can write testsWhere tests liveWhere it runs & your data
Manual QA Anyone — but slow and repetitive Docs or a test-management tool A person re-clicks every release; nothing is automated
Coded automation
Selenium · Cypress · Playwright
Engineers only A separate code repository Your CI servers; brittle selectors need constant upkeep
Cloud AI test runners Mixed The vendor's dashboard The vendor's cloud — your app and data leave your network
VibeTest this app Anyone, in plain English On the Jira issue itself Your own Mac, your own agent — nothing leaves your machine
Less maintenance, by design

Because an AI agent interprets each step against the live app, a button moving or a label changing usually doesn't break the test — the agent adapts. When something genuinely needs updating, you edit a plain-English sentence, not a page-object or a CSS selector.

Bring your own agent

VibeTest runs through the AI coding agent you choose — Claude Code by default, or any CLI agent you configure (see Use the desktop app). You control the model, the cost, and the environment; there are no per-run cloud-execution fees.

Who it's for

  • QA & test engineers who want coverage without maintaining a fragile automation suite.
  • Product managers & analysts who can finally write executable acceptance tests in the language they already use.
  • Developers who want a fast, AI-run check attached to the issue — using the agent and machine they already trust.
  • Security-conscious teams who can't send their code or data to a third-party testing cloud (see Security & privacy).

2 How VibeTest works

VibeTest has two halves that work together: a Jira app where you write and review tests, and a small desktop app on your Mac that actually runs them with an AI agent.

In your browser

VibeTest (the Jira app)

A panel on every Jira issue. Write tests in Behaviour-Driven (Given / When / Then) format or plain English, press Run test, and watch results appear — pass or fail, step by step, with screenshots.

On your Mac

AppDash AI Link (the desktop app)

A free macOS app that you pair once with your Jira site. It picks up the tests you launch, runs them through an AI coding agent (Claude Code by default), and reports the verdict back to Jira.

The end-to-end flow

When you press Run test in Jira, here is what happens behind the scenes:

1 · JiraYou press Run test on an issue.
2 · BridgeThe run is queued and sent to your paired Mac over a secure long-poll.
3 · Your MacAppDash AI Link runs the test with the AI agent.
4 · JiraThe verdict, steps, and screenshots stream back into the issue.
Why a desktop app?

The test runs on your machine, using your AI agent and your local environment — so it can reach internal sites, use your logins, and keep credentials on your Mac instead of in the cloud. Jira only ever sees the result.

What you need

  • A Jira Cloud site with the VibeTest by AppDash app installed (ask your Jira admin if you don't see the panel on issues).
  • A Mac to install the desktop app on (macOS).
  • An AI coding agent installed on that Mac. VibeTest uses Claude Code by default; you can point it at others (see Use the desktop app).

The rest of this guide walks through it in order: install the desktop app, pair it with Jira, then create, run, and review your first test.

3 Install the desktop app

Everything runs through AppDash AI Link, the free desktop companion. Install it first — you'll pair it with Jira in the next step.

  1. Download the app. Open appdash.ai/download and download the latest macOS build (a .dmg file). You'll also find this link inside Jira — in the VibeTest panel's empty state (Download →) and on the pairing page (Download now →).
  2. Install it. Open the .dmg and drag AppDash AI Link into your Applications folder, then launch it. On first launch macOS may ask you to confirm you want to open an app downloaded from the internet — choose Open.
  3. Find it in your menu bar. AppDash AI Link lives in your Mac's menu bar and opens a single window with four tabs: Connections, Activity, Console, and Settings. It opens on the Connections tab.
The AppDash AI Link desktop app on the Connections tab, showing a paired Atlassian Jira site under Sites with a live status dot.
The Connections tab — your home base in the desktop app. Once paired, each Jira site appears as a card under Sites with a live status dot. (Yours will be empty until you pair in the next step.)
Install your AI agent too

VibeTest runs tests through an AI coding agent on your Mac. If you haven't already, install Claude Code (the default). The desktop app auto-detects it; you can check or change this under Settings → Agents (covered in section 9).

4 Pair your Mac with Jira

Pairing links one Jira site to your desktop app, so runs you launch in Jira reach your Mac. You do it once per site, across two windows — the VibeTest settings page in Jira and the desktop app — confirming a short code on both so nobody can pair without your approval. Jira walks you through four stages: Generate → Send to desktop → Confirm → Connected.

  1. Open the Connections page in Jira. In Jira, go to Project settings → Apps → VibeTest by AppDash. The Connections page lists any desktops already paired to this project, and is where you pair a new one.
    The VibeTest by AppDash Connections page in Jira project settings, showing the paired macOS desktop under Your connection, a Pair AppDash AI Link button, and the AI-agent selector.
    Project settings → VibeTest by AppDash → Connections. Click Pair AppDash AI Link to begin. Don't have the app yet? There's a Download now → link right here.
  2. Generate the pairing link in Jira. Click Pair AppDash AI Link. Jira advances to Send to desktop and shows a short user code (note it — you'll check it in step 4) and a Copy pair link button. Click Copy pair link.
    The Send to desktop stage in Jira, showing a large user code V44-FE8VQ and Copy pair link, Show full URL, and Cancel buttons.
    Send to desktop. Jira generates a one-time link and a user code (here V44-FE8VQ). Copy the link — it's only valid for a few minutes.
  3. Paste the link into the desktop app. Switch to AppDash AI Link. On the Connections tab, click + Add Connection, paste the link into the box, and click Pair this device.
    The Add a Connection card in the desktop app, with a box to paste the applink URL and a Pair this device button.
    Add a Connection in the desktop app — paste the link Jira gave you, then click Pair this device.
  4. Check that the codes match. The desktop now shows "Pairing in progress" with the same user code plus an app fingerprint. Confirm the user code matches the one Jira showed in step 2 — this is the security check that proves you're pairing the right machine.
    The desktop Pairing in progress card showing a step checklist, the user code V44FE8VQ, an app fingerprint, and a Cancel button.
    Pairing in progress. The desktop shows the matching code (V44FE8VQ — same as Jira's V44-FE8VQ) and asks you to confirm back in Jira.
  5. Confirm in Jira — you're connected. Back on the Jira page, with the codes matching, click Confirm pairing. The tracker advances to Connected, and the desktop's Connections tab shows the new site under Sites with a green Polling dot. Your Mac is now listening for test runs from that site.
If pairing fails

Pairing links expire after a few minutes. If you see "The pairing code expired" or "signature invalid," generate a fresh link in Jira and paste the new one. If a connection later shows Auth failed, just re-pair from Jira — see Troubleshooting.

5 Create a test in Jira

Tests live on Jira issues. Every issue gets a VibeTest panel where you write, run, and review tests.

Open the VibeTest panel on an issue

Once your Jira admin has installed the app, each issue gains a Tests section — that's the VibeTest panel. Open any Jira issue and scroll down, past the description and fields, to find it.

A Jira issue with the VibeTest panel embedded as a Tests section, showing status tiles and a list of tests with pass/fail results.
The VibeTest panel lives in the Tests section of every issue, between the issue's fields and its activity. Not seeing it on an older issue? Open the issue's ••• (more actions) menu to add the app's panel, then refresh the page.

On an issue with no tests yet, the panel shows a welcome screen inviting you to create your first one.

The VibeTest panel welcome screen with three cards: BDD Scenario (recommended), Free-Form Task, and Generate with AI.
The welcome screen on an issue with no tests yet. Choose how you want to write the test: a structured BDD Scenario, a plain-English Free-Form Task, or Generate with AI.

Three ways to write a test

TypeBest forHow you write it
BDD Scenario Recommended Precise, reviewable tests with clear steps. Structured Given / When / Then steps. Each step is checked individually, so results show exactly which step failed.
Free-Form Task Quick checks where you'd rather just describe the goal. A plain-English description of what to test and what success looks like. The AI decides how to carry it out.
Generate with AI Drafting tests fast from a description of the issue. Describe what to cover; AppDash AI Link (or, with no Mac paired, Rovo AI inside Jira) drafts BDD tests from this issue for you to review and edit.

Writing a BDD scenario

Click BDD Scenario. The editor opens with your test as a list of steps — each a coloured keyword plus a plain-English sentence. The title you gave the test becomes the scenario name.

The BDD editor: a Not run yet pill, then three colour-coded steps — GIVEN in green, WHEN in blue, THEN in purple — each with a sentence and row actions, above an Add And step button and an Advanced disclosure.
The BDD editor. A run-status pill up top, one row per step, then the Add step button and an Advanced section. You build the scenario one step at a time.

Anatomy of a step

Reading a step row from left to right:

  • A status dot shows that step's result after a run, and a grip handle beside it lets you drag the step to reorder it (or focus it and use the arrow keys).
  • The keyword — a coloured dropdown (Given / When / Then / And / But). Click it to change the keyword.
  • The sentence — a plain-English text box describing the step; it grows as you type.
  • Row actions on the right — add a data table, duplicate the step, or delete it.

Given, When, Then — what each step means

BDD describes behaviour as a short story: set the scene, take an action, then check the result. Each keyword has a job (and a colour), and every step is checked individually — so a run shows exactly which one failed.

KeywordWhat it's forExample
GivenThe starting context — set the scene before anything happens.Given Alex is on the login page
WhenThe action under test — the one thing you're exercising.When Alex signs in with valid credentials
ThenThe expected outcome — what must be true for the test to pass.Then Alex sees the dashboard
And / ButContinue the previous step. And adds another of the same kind; But adds a contrast or negation.And the banner shows their name · But no error appears
Three BDD steps with colour-coded keywords: GIVEN in green, WHEN in blue, THEN in purple, each followed by a plain-English sentence.
Colour-coded keywords. Given sets up, When acts, Then checks — and the same colours carry through to the run results.
Keep steps small

One idea per step. A focused Given → When → Then reads clearly, and when it fails the result points at a single sentence rather than a paragraph.

Adding steps

The blue + Add … step button adds the next step and suggests the natural keyword — after a Given it offers When, then Then, then And. To add a specific keyword instead, click the caret on the right of the button and pick one.

The Add And step button with its caret menu open, listing Given, When, Then, And, and But — each with a matching colour swatch.
Add a step. The primary button adds the suggested keyword; the caret opens the full list so you can pick any of Given / When / Then / And / But.
Faster step entry

Press Enter at the end of a sentence to add the next step without reaching for the mouse; Shift+Enter inserts a line break within a step. Use the duplicate icon to copy a similar step, and the trash icon to remove one.

Reordering steps

Steps run top to bottom, so order matters. To move one, hover the step to reveal its drag handle (the grip on the left), then drag it up or down — a teal line shows where it will land. Prefer the keyboard? Tab to the handle and press / .

The three steps with their drag handles visible on the left and a teal drop-indicator line above the first step, showing where a dragged step will land.
Reordering. Grab a step's handle and drag; the teal line marks the drop position. The handle appears when you hover a step (or focus it with the keyboard).

Adding a data table to a step

A data table attaches a small grid of structured data to a step — handy for example inputs such as credentials, products, or parameters. Click the table icon in a step's row actions to add one.

A WHEN step with a data table attached: columns username and password, two example rows using secret placeholders for the passwords, and Add row, Add column, and Remove table controls below.
A data table on a step. Name the columns in the header row, then add one row per example. Cells accept secret placeholders like {{secrets.STD_PW}}.
  • Edit any header or cell by clicking it.
  • + Add row / + Add column grow the table; hover a row or column and click its to remove it.
  • Remove table detaches the table from the step.

Save it

Click Save in the top bar. A "Saved" confirmation flashes and the test joins the list on the issue. Your edits are held locally until you save, so you won't clash with someone editing the same test at the same time.

More options under Advanced

Open Advanced (below the steps) to Import Gherkin by pasting a scenario to replace the steps, or preview the exact prompt sent to the agent. To keep a password out of the saved test, reference a stored secret with {{secrets.NAME}} in any step or table cell — see Use secrets in your tests.

Prefer free-form? Click Free-Form Task instead and describe the test in two boxes: the Task (what to do) and the optional Success criteria (how to tell it passed).

Generate tests with AI

Click Generate with AI (or choose it from the New Test menu) to let the AI draft a BDD test for you. Describe what to cover in the Requirements box and click Generate. The AI drafts a BDD scenario you can review, edit, and save. With a paired Mac your local agent produces the draft; with no Mac paired a confirm dialog offers Generate with Rovo AI to draft it inside Jira instead. Note the current MVP limit: one test per generation.

6 Manage your tests

Once an issue has tests, the panel shows them as a list. The top of the panel gives you an at-a-glance summary and a button to add more.

The test list with status tiles reading 1 passed, 1 failed, 0 running, 0 queued, a New Test button, and two test rows with status pills.
The test list. The tiles across the top — passed, failed, running, queued, not run — count your tests by their latest result. Each row shows the test's title, type, last result, and when it last ran.

Reading the list

  • Status tiles count tests by their latest run. Click a tile (e.g. failed) to filter the list to just those tests; a banner appears with a Clear filter link.
  • Each row shows a status icon, the title, the type (BDD or Free Form), a status pill (passed failed running queued), and the time of the last run. A failed test also shows a one-line summary of what went wrong.
  • A FLAKY chip appears when a test has been giving mixed results across its recent runs.
  • Tests stay in the order you arrange them. Drag a row by its grip to reorder it (or focus a row and press ↑/↓); the order is saved. Reordering is available when no status filter is active.

Adding more tests

Click New Test (top-right) and pick BDD test, Free-Form test, or Generate with AI — the same flows from section 5.

Opening and editing a test

Click any row to expand it. The row and its editor fuse into a single teal-outlined focus card so the test you're working on stands out from the rest of the list.

An expanded test focus card showing the editor in edit mode with a Run test button, the scenario steps, and a passed run beneath it.
The focus card. Expanding a test shows its full editor plus its run history. From the sticky top bar you can Save edits, Run test, or open the menu to Duplicate or Delete.
  • Edit the title or any step, then click Save. A "Saved" flash confirms it. Your edits are kept locally until you save, so you won't lose work if someone else changes the test at the same time.
  • Duplicate (in the menu) makes an identical copy to tweak — handy for testing variations.
  • Delete (in the menu) permanently removes a test and its run history after a confirmation — this can't be undone.

7 Run a test

Running a test sends it to your paired Mac, where the AI agent carries it out for real. You start it right from the panel.

  1. Open the test by clicking its row to expand the focus card.
  2. Click ▶ Run test in the editor's top bar. (Run test appears on any saved test — BDD or Free-Form; it's disabled only while a run is already in progress.)
  3. Confirm in the dialog. A short "Run this test with your AI agent?" panel names the device the run will go to; click Run test to dispatch (or Cancel to back out).
  4. Watch it go. A run card appears and moves through these states:
    • Queued — sent to your Mac, waiting for it to pick up.
    • Running — the agent is executing. For BDD tests the step checklist lights up step by step in real time, with a spinner on the current step.
    • Passed / Failed — the final verdict (covered next).
First time? Two things to check

A test can only run if your Mac is paired (section 4) and the desktop app is open and polling. If you click Run test with no paired Mac, VibeTest stops you with a "No AI Link connection to run this test" dialog asking you to pair first — nothing is sent until a Mac is connected.

If a run gets stuck

If a run runs unusually long, a Stop Run button appears on the run card (a few seconds after it starts running). Click it to cancel; the run is marked Cancelled. Each run also has a built-in timeout that auto-stops a run that runs too long.

8 Review the results

When a run finishes, its card fills in with everything you need to understand what happened — the per-step outcome, evidence, screenshots, and an audit trail.

A passing run

A green Passed run shows every step with a checkmark and how long each took. The editor's run pill reads, for example, "Passed · 3/3 steps · 2m 58s." The first time a test ever passes, you'll get a little "Test passed for the first time!" celebration.

A passed test: the focus card with all three steps checked green and a green passed run card.
A passing run. Each Given/When/Then step is ticked green. Older runs are listed beneath the latest one so you can see the test's history.

A failing run

A red Failed run pinpoints the exact step that failed and shows the evidence the agent gathered:

A failed test showing the failing step in red, an Expected vs Actual evidence panel, a What to do remediation note, and an audit footer.
A failing run. The failing step is highlighted red. Below it: an Expected vs Actual comparison, a plain-English What to do suggestion, and an audit footer with the run ID, agent, model, and failure category.
  • Step checklist — steps before the failure are ticked; the failing step is marked with a red ✗; later steps are skipped (they were never reached).
  • Expected vs Actual — what the test was looking for versus what actually happened.
  • What to do — a suggested fix written by the agent.
  • Screenshots — when the agent captured the screen, a screenshot of the moment of failure appears; click it to enlarge and step through any others.
  • Audit footer — the run ID, which Agent/Model ran it, the agent's CLI version, and a failure category (e.g. assertion_failed, timeout).
Other verdicts

Errored means the run couldn't complete (a crash, timeout, or setup problem) rather than a test that genuinely failed — the card explains what to fix. Cancelled means someone pressed Stop Run.

Run history

Recent runs are kept (the panel shows the latest 10; your Mac keeps the full history under Activity). The most recent is shown expanded; click Show N more runs to review older ones.

Recording a result by hand

You can Record a result manually (Pass or Fail, with optional screenshots) from a test's run history without running on a Mac — useful when you have no paired Mac or are reviewing evidence gathered elsewhere. Manual runs are marked Manual to distinguish them from agent-executed runs.

9 Use the desktop app

Most of the time AppDash AI Link just runs quietly in your menu bar. When you want to check on it, its four tabs cover connections, run history, low-level logs, and settings.

Connections — your paired sites

The Connections tab (shown in section 3) lists every paired Jira site under Sites, each as a card with a live status dot. Expand a card for its actions:

  • Test — run a quick connectivity check against that site.
  • Jobs — jump to the Activity tab filtered to this site.
  • Network log — jump to the Console tab filtered to this site.
  • Pause / Resume — temporarily stop (or restart) listening for that site.
  • Remove — unpair the site and delete its locally stored tokens (this can't be undone — you'd re-pair to reconnect).

Activity — your run history

The Activity tab is a searchable table of every test run this Mac has executed: when it started, its status, type, who triggered it, the issue, the verdict, and how long it took (a Source column also appears once you have more than one connection). Click a row for the full detail, including the step list and the agent's transcript. While a run is still in progress, open it and click Stop to cancel it — the run is stopped and recorded as cancelled in Jira. Use Clear Log to empty the table.

The Activity tab showing a searchable table of test runs with columns for started, status, type, user, issue, verdict, and duration.
Activity — the history of every run on this Mac. Search by issue, verdict, or run ID.

Console — the technical log

The Console tab is for diagnosing problems. It has three sub-views in a left list: Network log (the app's HTTP calls to Jira, agent subprocess launches, and pairing messages — colour-coded by success or error; routine background "heartbeat" polls are hidden by default, use the Show menu to reveal them; click a row to inspect the full request and response, or a run's launch to read its conversation), Audit log (the server-side security ledger for your Atlassian connections — pairings, token rotations, scope checks), and Events (a local record of actions on this Mac — pausing/resuming connections, settings changes, sleep/wake).

The Console tab showing a three-sub-view left list with Network log, Audit log, and Events, with the Network log selected and HTTP requests and subprocess calls listed with status colours.
Console — three sub-views: Network log, Audit log, and Events. You'll mostly use this when troubleshooting.

Settings — agents and preferences

The Settings tab opens on Agents, where you choose and configure the agent that runs your tests.

Settings on the Agents screen, showing a flat list of agent profiles with Built-in default rows, named profiles, and an Add custom agent option, with a sidebar grouping AI and General settings.
Settings → Agents. The agent marked Default runs every test that doesn't pick its own. The sidebar holds the rest of the settings.
  • Default agent — the agent used for any run that doesn't pin its own (Claude Code out of the box). Click Set as default agent on a healthy agent to switch.
  • Profiles — each agent ships with a built-in Default profile and can have any number of named profiles. A test in Jira can pin a named profile by name; the Default runs otherwise.
  • Add custom agent — point AppDash AI Link at any coding-agent CLI (name, command, output format, launch template).
  • Open a profile (the arrow) to configure it: its binary (auto-detected, Re-detect, or Browse), an optional working directory (blank = a fresh sandbox each run; a real path lets the agent touch project files), the launch command template, per-profile environment variables (which can be marked secret), advanced timeouts, a live command preview, and a Test connection button.
An agent profile configuration screen with binary path, working directory, launch command template, environment variables, advanced timeouts, command preview, and a Test connection button.
Configuring a profile — where the desktop app finds the agent binary and how it's launched.

Other items in the Settings sidebar: Relay clients (pair an iPhone for read-only status checks — off by default), Project secrets (store credentials for your tests — see section 10), and About (version, update check, and the Forget me data-erasure wizard at the bottom).

10 Use secrets in your tests

Real tests often need a password, an API token, or an internal URL — and you don't want those typed into the test, which is stored in Jira. Secrets solve this: store the value once on your Mac, give it a name, and reference it in a step as {{secrets.NAME}}. Your Mac swaps in the real value at run time, so Jira only ever sees the name.

How a secret flows

A secret's value never leaves your Mac — only its name travels to Jira, so the editor can offer it as a suggestion:

1 · Your MacYou store STD_PW = the real password in the desktop app. It goes into the macOS Keychain.
2 · Name only → JiraThe desktop tells Jira the name exists — never the value — so the editor can autocomplete it.
3 · In the testYou reference {{secrets.STD_PW}} in a step. That placeholder is what Jira stores.
4 · At run timeYour Mac swaps the placeholder for the real value, runs the test, then scrubs the value out of the results.
The guarantee

The secret value lives only in your Mac's keychain, and is used only in memory while a test runs. It is never written into the test, never sent to Jira or AppDash, and — as you'll see below — actively stripped out of the results that come back. Jira stores only the {{secrets.NAME}} placeholder and the secret's name.

Step 1 · Store the secret on your Mac

Secrets live in the desktop app, grouped by Jira project. Open AppDash AI Link, go to the Settings tab, and choose Project secrets from the sidebar (under AI).

The Project secrets screen in the desktop app's Settings tab, showing collapsible groups per Jira project, each listing secret names with a masked Stored badge and a delete icon.
Settings → Project secrets. One group per Jira project, listing the names you've stored. Each value shows only a Stored badge — it stays in your OS keychain and is never displayed. (Yours will be empty until you add your first one.)
  1. Open the Add-secret form. Click Add secret on a project's group, or Add secrets for another project… at the bottom to start a brand-new project.
  2. Name it and paste the value. Give the secret a name — letters, digits, hyphens, and underscores, e.g. STD_PW — and paste its value into the masked field. Click Add. The value is written straight to your keychain.
    The Add-secret form within a project group: a Secret name field, a masked Value field labelled stored once never shown again, and Add and Cancel buttons.
    Adding a secret. The value field is masked, and once saved it's write-only — stored in your keychain and never shown again, even to you.
  3. Match the project key. A secret is scoped to one Jira project key — the prefix of your issue keys (the ENG in ENG-123). A test on an ENG issue can only use secrets stored under ENG, so when you add secrets for a new project, type that exact key in the Project key field.
Values are write-only

For safety a stored value can never be read back — not by the app, not by you. To change it, add the secret again with the same name and the new value replaces the old. To remove it, click the trash icon and confirm; the value is erased from your keychain and can't be recovered.

Step 2 · Reference it in a Jira test

In the BDD editor, type {{ in any step body and an autocomplete list of your project's secret names appears. Pick one to insert a complete {{secrets.NAME}}. Secrets resolve in both test types — BDD steps and Free-Form Task fields (the Task and Success-criteria boxes).

A BDD step body with the secret autocomplete open: a listbox headed secrets dot with a count, listing stored secret names each with a key glyph, and a footer showing arrow keys to move, enter to insert, escape to dismiss.
Secret autocomplete. Typing {{ opens the names stored for this issue's project across your paired Macs. Type to filter; move, inserts, Esc dismisses.

A step that references a secret is tagged with a small secret badge (a shield), so it's easy to see which steps depend on a stored value. The suggested names are the union from every Mac paired to this project — so you can reference a teammate's secret too; it simply resolves on whichever Mac runs the test.

Two BDD steps that reference secrets via double-brace placeholders, each showing a shield secret badge beneath the step text.
The secret badge. Any step containing {{secrets.NAME}} is tagged. Reference a name the project doesn't recognise and an advisory note appears — it won't block saving, but the run only succeeds if a paired Mac actually defines that secret.

What happens when the test runs

The moment you press Run test, three things happen on your Mac — never in the cloud:

  • Resolve. Just before launching the agent, your Mac looks up each {{secrets.NAME}} in the keychain (for the issue's project) and swaps in the real value. The agent runs against the real credentials.
  • Fail closed. If a referenced secret isn't stored on the Mac running the test, the run doesn't proceed with a blank — it comes back Errored with a secret-resolution message naming what's missing. Add the secret and run again.
  • Redact. The agent's output can echo a value back (say, printing a URL it fetched). Before any result leaves your Mac, every resolved value is replaced with its {{secrets.NAME}} placeholder — across step messages, the verdict, and failure detail alike — so it can't surface in a Jira comment, the panel, or the run history.
Secrets never travel to Jira

Because both the resolve and the redact steps run on your Mac, a secret value exists in exactly one place — your keychain — plus briefly in memory during a run. Jira and AppDash never receive it. (One minor limit: very short values, under four characters, aren't masked in echoed output — no realistic password, token, or URL is that short.)

Manage your secrets

TaskHow
Update a valueAdd the secret again with the same name — the new value replaces the old. (You can't view the old one.)
Delete a secretClick the trash icon beside it and confirm. It's removed from your keychain permanently; tests that reference it will error until you re-add it.
See what's storedThe Project secrets panel lists every project and name you hold. Values are never shown — only that each is Stored.
Share across a teamEach teammate stores the same-named secret on their own Mac under the same project key. The test references the name; whoever runs it resolves it locally.
Keep secrets out of plain text

Anywhere you'd otherwise type a password or token — a login step, a data-table cell, an API call — use {{secrets.NAME}} instead. The test stays shareable and reviewable in Jira, and the sensitive part lives only on the machine that runs it.

11 Security & privacy

VibeTest is built so that your most sensitive assets — source code, credentials, and customer data — never leave your control. This section summarises the architecture and controls a corporate security review typically asks about.

Where your data lives

There are only two places VibeTest keeps anything, and you own both of them:

Your Jira tenantThe VibeTest app stores your test definitions, runs, and results — inside your own Atlassian Cloud site.
Encrypted bridgeRuns and results travel over HTTPS between Jira and your Mac. No AppDash-operated server sits in the middle.
Your MacThe desktop app and your AI agent execute the test. Your code, logins, and secrets stay here and are never uploaded.
The core guarantee

In the configuration described in this guide, your test data flows only between your Jira site and your paired Mac. The vendor (AppDash) operates no backend that receives your code, credentials, or test data — so there is no third-party copy of your information to breach, subpoena, or mishandle.

Security controls at a glance

A reviewer-friendly summary of how VibeTest handles the questions that come up most often:

Control areaHow VibeTest handles it
Data residencyTest definitions and results are stored in Atlassian Cloud storage inside your own Jira Cloud tenant. Execution data (transcripts, screenshots) is produced and kept on your Mac.
Data in transitHTTPS/TLS everywhere. The Jira app's endpoints are TLS-only; the desktop app reaches them over HTTPS.
Data at restAtlassian encrypts the stored app data at rest. On the desktop, access tokens and secrets are held in the macOS Keychain (OS-encrypted), not in plain files.
Third-party backendNone in this configuration. The Jira app declares no external-fetch permission, so it cannot send your data to any outside server.
AuthenticationEach connection has its own scoped tokens. Pairing is a mutual challenge–response with a time-limited code and an app fingerprint that you confirm on both Jira and the desktop, so a connection is created only with your explicit approval on each side.
Least privilegeThe app requests a small, standard set of Jira scopes (listed below) and nothing more. The authoritative scope list is shown to your admin at install/consent.
Network exposureFor the test-running workflow, the desktop app is outbound-only — it polls your Jira site over HTTPS. It needs no inbound ports, port-forwarding, or firewall changes.
Source & credential isolationYour repository, logins, internal URLs, and secrets are used by the local agent and are never sent to Jira or AppDash. Jira receives only the verdict, step outcomes, and the evidence you see in the panel.
AuditabilityAtlassian keeps an audit trail of bridge activity; the desktop app records every run (Activity) and every network and subprocess call (Console).
Revocation & erasureUnpair a site to delete its local tokens, revoke a connection from Jira, or use Settings → About → Forget me to wipe all locally stored data at once.
Software integrityThe macOS app is code-signed and notarised by Apple, and updates are delivered through a signed auto-update feed. A minimum-version gate retires outdated clients from the bridge.

Jira permissions (scopes) the app requests

VibeTest asks for only what it needs to read issues, post results, and store its own data — five Jira scopes in total:

ScopeWhy it's needed
read:jira-workRead the issue a test belongs to, for context during a run.
write:jira-workPost test results and evidence back onto the issue.
storage:appStore the app's own data (tests, runs, connection records) in Atlassian Cloud storage.
read:jira-userResolve the display name of whoever last saved a test, for attribution.
report:personal-dataReport the account IDs the app stores to Atlassian's privacy service, so personal-data deletion requests are honoured (a Marketplace GDPR requirement). It enables no external network access.

The Jira side runs on Atlassian's hosted runtime

The Jira side of VibeTest runs entirely inside Atlassian's hosted, sandboxed runtime, with per-tenant data isolation and Atlassian-managed encryption — there is no separate AppDash-hosted cloud to assess. (The test-execution agent runs on your own Mac, not on Atlassian — so the product as a whole is not an Atlassian "Runs on Atlassian" app; this section describes only the Jira-hosted half.) For Atlassian's platform certifications, sub-processors, and data-residency options, point your reviewers to the Atlassian Trust Center and the app's Marketplace listing.

What to hand your security reviewer

Most reviews are satisfied by four facts from this page: (1) the data-flow diagram above — data stays between your Jira tenant and your Mac; (2) the app requests only the five Jira scopes listed; (3) there is no third-party backend and no external-fetch permission; and (4) tokens and secrets are held in the macOS Keychain and can be erased at any time. Pair that with the Atlassian Trust Center for the underlying platform.

Your responsibilities

Because tests run on your machine with your agent, a few things stay in your hands:

  • Protect the Mac. Anyone with access to the paired Mac can run tests against the connected site. Use full-disk encryption (FileVault) and a screen lock.
  • Mind what a test can reach. The agent runs with your local permissions and logins. Review scenarios that touch production systems, and prefer non-production accounts where you can.
  • Use secrets, not plain text. Reference credentials with {{secrets.NAME}} (see Use secrets in your tests) so they aren't written into the test definition stored in Jira.

12 Troubleshooting

Most issues come down to a connection that needs attention or the desktop app not running. Start with the status dot on the Connections tab.

Connection statuses and what to do

StatusWhat it meansWhat to do
PollingHealthy — listening to Jira for test runs.Nothing. This is the normal state.
IdleRegistered but not actively polling right now.Nothing; runs still arrive within seconds.
RunningA test is executing on your Mac right now.Wait for it to finish.
RetryingA temporary network or server hiccup; it will retry automatically.Usually self-heals. If it persists, check your internet.
Auth failedThe stored access tokens expired or were revoked.Re-pair the site from Jira (use the Re-pair button on the card).
PausedYou paused polling for this site.Click Resume on the card.
Update requiredThe desktop app is too old for the current bridge.Update AppDash AI Link (Settings → About → Check for updates).

Check the wiring: Test connection

To confirm your Mac can reach the AI agent, open Settings → Agents, select your agent environment, and click Test connection. It runs a tiny PONG prompt through the agent's full launch path. A "Ready ✓" result (with the round-trip time) means the desktop-to-agent link works; a "Failed" result points at an agent that isn't installed or configured — re-check the environment's command and binary path on the same screen.

The agent environment configuration screen with a Test connection button and a Ready result showing the round-trip time.
Test connection — the quickest way to confirm your Mac can talk to the AI agent.

Common problems

SymptomLikely cause & fix
Run comes back "No paired desktop device"Your Mac isn't paired, or the app isn't running. Open AppDash AI Link and confirm the site shows Polling; pair it if it's missing (section 4).
Runs never start (stay Queued)The desktop app may be fully quit, or the connection is paused. Open AppDash AI Link (it keeps polling in the tray even when the window is closed, but not after you Quit it), and check the site isn't Paused — click Resume if it is.
Card shows Auth failed or "token missing"Re-pair the site from Jira. Tokens expire over time; re-pairing issues fresh ones.
A test failed with a "site blocked" messageThe browser extension limits which sites the agent may visit. Add the target site to the allowlist as the run card suggests.
Pairing won't completeThe link expired (they're valid only a few minutes) — generate a new one in Jira. Confirm the code/fingerprint match on both sides.

For a deeper look, the Console tab shows the exact requests and errors, and its Pair history sub-view records why past pairings succeeded or failed.

Privacy: erase everything

Everything VibeTest stores on your Mac — connections, tokens, activity, and logs — lives there, not in the cloud. To wipe it all, open Settings → About → Forget me and confirm. This permanently deletes the local data and unpairs your sites.

The Forget me section inside the About page, listing the local data that will be deleted.
Settings → About → Forget me — a one-click way to remove all locally stored data.
Still stuck?

Confirm all four are true: the desktop app is open, the site shows Polling, the Test connection check passes, and your AI agent is installed. That covers the large majority of issues. If a problem persists, the Console tab and Settings → About (for the version) are the details to share when you report it.