Accessibility and Security Testing with AI: Safe First Steps

Two kinds of defects are easy to miss: those that block people with disabilities, and those that expose data. Testers can catch many of these early. In this lesson you will take safe first steps in accessibility and security testing with AI, and learn why tools alone can never give you the full picture.

---

💡 What Is Accessibility Testing?

Common checks include keyboard use, form labels, colour contrast, image descriptions and clear headings. WCAG is the widely used standard.

---

🔍 An Automated Accessibility Scan

Install the axe integration:

npm install -D @axe-core/playwright

This test scans a page for WCAG A and AA rules and fails on serious problems.

import { test, expect } from '@playwright/test';
import AxeBuilder from '@axe-core/playwright';

test('page has no serious automatic accessibility issues', async ({ page }) => {
  await page.goto('https://sqatools.in/automation-practice-page/');

  const results = await new AxeBuilder({ page })
    .withTags(['wcag2a', 'wcag2aa'])
    // Third-party ads change on every load and are outside this page's code.
    .exclude('ins.adsbygoogle')
    .analyze();

  const serious = results.violations.filter(
    (violation) => violation.impact === 'serious' || violation.impact === 'critical',
  );

  expect(serious).toEqual([]);
});

The exclude line skips third-party ads, which can change on every page load. Only exclude content that you do not control, and say in your report what you left out. If this test fails on a practice page, read each violation as a learning exercise. Do not simply turn off the rule. If you are new to writing these tests, start with Generate Playwright Tests with AI.

---

🧩 Accessibility and Security Testing with AI: Where It Helps

AI can explain a violation in plain language, suggest a fix for developers and list manual checks. Then a person must check real use.

Manual check	How to try it
Keyboard only	Use Tab, Enter and Escape without a mouse
Focus	Can you always see where you are?
Screen reader	Do announcements make sense?
Zoom	Is it usable at 200%?
Error messages	Are they clear and linked to fields?

---

🛠️ First Steps in Security Testing

Testers can check many basics as part of normal work. The OWASP Top 10 is a good introduction.

Basic check	Example
Authentication	Protected pages reject anonymous users
Authorisation	One user cannot open another user’s order
Input handling	Unexpected text is handled safely
Sensitive data	Errors do not reveal internal details
Session	Logging out ends access

This real test checks that a protected endpoint on our practice API rejects a request that has no token.

import { test, expect } from '@playwright/test';

test('profile endpoint rejects anonymous requests', async ({ request }) => {
  const response = await request.get(
    'https://sqatools.in/wp-json/sqa-api/v1/auth/me',
  );

  expect(response.status()).toBe(401);
});

---

🌍 Real-Life Example: Changing an ID

A tester uses a test account to open /orders/1001. Using another test account that owns a different order, the tester tries that same URL. If the order appears, one user can see another user’s data. AI can suggest this idea, but only a real test on an approved system can confirm it.

---

🧪 Try It Yourself

1. Run the accessibility scan on the practice page.
2. Pick one violation, and use the prompt below to understand it.
3. Try the same page using only your keyboard.
4. Note anything that the scan did not find.
5. Run the anonymous request test against the practice API.

---

📋 Ready-to-Copy Prompt

You are an accessibility specialist helping a QA engineer.

Violation from an automated scan:
[paste rule, impact, description and HTML with no personal data]

Please provide:
1. A plain-language explanation of who this affects
2. Likely fix options for a developer
3. Manual checks to confirm the problem and the fix
4. Anything an automated tool cannot confirm

Do not claim that the page is compliant with any standard.

---

⚠️ Common Mistakes

• Treating a clean scan as proof of accessibility
• Disabling rules to get a passing test
• Scanning systems without permission
• Using real accounts for security checks
• Posting security issues in public channels

---

🎯 Key Takeaways

• Automated scans find only some accessibility problems.
• Keyboard and screen reader checks remain essential.
• Security testing needs clear permission and scope.
• Report sensitive findings through the proper process.

---

🎤 Interview Questions

1. What is accessibility testing?

Model answer: It checks that people with different abilities can use a product, including those using keyboards or screen readers. Teams often use WCAG as a reference, with both automated and manual checks.

2. Can automated tools fully test accessibility?

Model answer: No. They find many technical issues, such as missing labels. They cannot fully judge meaning, usability or a real screen reader experience, so manual testing is still needed.

3. What is the difference between authentication and authorisation?

Model answer: Authentication confirms who a user is. Authorisation decides what that user can access or do. A logged-in user may still be unauthorised to view another user’s data.

4. What is an insecure direct object reference?

Model answer: It occurs when an application uses an identifier from the request without properly checking permission. For example, changing an order ID could expose another user’s order.

5. How can AI support security testing responsibly?

Model answer: It can suggest test ideas and explain concepts. I use it only for approved systems, keep sensitive data out and confirm findings through authorised testing and the security team.

---

📝 Assignment

Run an accessibility scan and a keyboard-only review of one practice page. Then write five basic authorisation and authentication test ideas for a made-up application. Mark which ones could be automated.

---

❓ FAQ

Is a passing axe test enough for legal compliance?

No. It can support your work, but compliance needs a broader review. Ask qualified specialists when legal requirements apply.

Can testers do security testing without being specialists?

Yes, for basic checks in normal test scope. Deeper penetration testing needs specialist skills and explicit authorisation.

---

🚀 Next Steps

Well done on finishing this lesson. Complete the assignment, then continue with Flaky Test Diagnosis with AI: Triage CI Failures Faster.