Question
qTest Public Link defaults and token persistence during 11.0 migration
Cig Lane
0 reputation · 19 Aug 2026, 18:21 UTC
145.8K views
Loading…
0 reputation · 19 Aug 2026, 18:21 UTC
qTest 11.0 (SaaS) introduced a default-deny posture for public links and new token rotation policies to prevent unauthorized access to test artifacts. However, the migration process from versions 9.x or 10.x to 11.0 does not automatically apply these restrictive defaults to existing project configurations.
Projects created in SaaS versions 9.3 through 10.0 often have the Public Link feature enabled by default in Administration > System Settings. Additionally, API tokens generated prior to version 10.1 lack automatic expiration and may remain active even after the creator's account is deactivated.
Because the migration to 11.0 preserves existing project settings and token validity to avoid breaking integrations, there is a risk of persistent, unauthenticated access vectors remaining active in the new environment.
34775 reputation · 20 Aug 2026, 04:45 UTC
The qTest 11.0 migration utility does not provide a native mechanism to bulk-disable public links for legacy projects. Because the migration prioritizes backward compatibility to prevent breaking existing integrations, project configurations from versions 9.x and 10.x retain their permissive public-link settings in the 11.0 environment.
Similarly, there is no built-in programmatic "button" to revoke API tokens created prior to version 10.1 across multiple projects. These tokens remain active because the migration process preserves existing token validity, regardless of whether the original creator's account has been deactivated.
To secure a legacy-qTest environment after a 11.0 migration, administrators must manually audit and update configurations using the following approach:
qtestPublic Link is enabled.This analysis assumes the environment is a SaaS-hosted instance of qTest 11.0. It is uncertain whether specific enterprise-level patches or custom API plugins have introduced hidden management tools that are not documented in the standard migration utility. Furthermore, the persistence of tokens for deactivated users depends on the specific sub-version of 11.0 and may vary with minor patch updates.
To verify the state of your environment, use the following scoped API command to check project settings:
# Example: Checking for public link status via API
curl -X GET "https://{your-instance}.qtest.com/api/v3/projects/{project-id}/settings" \
-H "Authorization: Bearer {your-token}"Use comments to ask for clarification. Post a solution as an answer.
34,775 reputation · 20 Aug 2026, 02:22 UTC
When addressing the persistence of legacy access vectors, it is critical to distinguish between project-level sharing and global system-wide defaults. While the migration utility preserves existing configurations to prevent integration breakage, the primary risk lies in the Public Link feature bypasssing standard role-based access controls.
To verify the environment state, administrators should use the qTest REST API to query the publicLinkEnabled flag across all projects. Since deactivating a user account does not reliably revoke associated API tokens in many SaaS environments, a manual rotation strategy is required for any tokens created prior to the 10.1 security update.