qTest Public Link defaults and token persistence during 11.0 migration

Project Access Control Transition

qTest 11.0 (SaaS) introduced a default-deny posture for public links and new token rotation policies to prevent unauthorized access to test artifacts. However, the migration process from versions 9.x or 10.x to 11.0 does not automatically apply these restrictive defaults to existing project configurations.

Security Gaps in Legacy Configurations

Projects created in SaaS versions 9.3 through 10.0 often have the Public Link feature enabled by default in Administration > System Settings. Additionally, API tokens generated prior to version 10.1 lack automatic expiration and may remain active even after the creator's account is deactivated.

Because the migration to 11.0 preserves existing project settings and token validity to avoid breaking integrations, there is a risk of persistent, unauthenticated access vectors remaining active in the new environment.

• Does the qTest 11.0 migration utility provide a mechanism to bulk-disable public links for all legacy projects?
• Is there a programmatic method to identify and revoke all API tokens created prior to the 10.1 security update across multiple projects?