FAQ
What pages and endpoints does it test?
The agents test whatever is reachable inside your scope. A crawling agent walks the application, follows links, submits forms, and records each endpoint and parameter it discovers. The crawl respects your excluded paths. Anything outside your target URLs (and any allowed domains you add) is unreachable from the sandbox.
Which vulnerability categories does it cover?
The testing stage covers OWASP Top 10 categories: injection, broken authentication, sensitive data exposure, cross-site scripting, server-side request forgery, and more. The agents also reason about the application's specific logic to find issues a scanner would miss.
How do I protect staging or production?
Three controls protect the environment:
- Rate limiting: set a requests-per-second cap so the agents do not overwhelm the target.
- Excluded paths: list URL paths to skip, to shield sensitive endpoints and avoid destructive actions.
- Scope boundaries: the sandbox can reach only your target URLs and allowed domains, so the test stays where you intend it.
Do I need to give credentials?
No. Authentication is optional. Without credentials the agents test only what is reachable anonymously. To reach authenticated areas, describe the login flow and provide test credentials. Use a dedicated test account, not a real one.
Will it test my internal services?
No. The sandbox reaches only the target URLs you provide plus any allowed domains you configure. It cannot reach internal services or any host outside your allowlist.
Does it follow redirects to outside domains?
No. If the agent meets a redirect to a domain outside your configured scope, it does not follow it. This keeps the test in bounds even when your application links to external services.
Does it have access to my source code?
No. The black-box pentest is blind. It probes your live application over HTTP and through a headless browser, and it never receives or inspects your source code. If you want source-level analysis, use Source Code Audit.
Is my target safe from accidental damage?
The agents operate inside isolated sandboxes that are destroyed when the run ends. The crawl respects excluded paths and rate limits, and the sandbox cannot reach anything outside your scope. No artifacts, including credentials or session tokens, persist after the assessment.
What happens if my target is down or unreachable?
Validation is the first stage. The agent sends a probe request to each target URL and attempts the authentication flow you described. If the target is unreachable or authentication fails, the run stops with a clear message so you can fix the configuration before wasting time.
What does a finding look like?
Each confirmed finding carries a proof-of-concept with the exact HTTP request and the response that proves exploitation, reproduction steps, an impact assessment, and a suggested fix. Findings map to a standard category (CWE or OWASP) where applicable, carry a severity, and move through a status lifecycle you control.
Who decides what is a real vulnerability?
A triage agent re-examines each finding's evidence, confirms or rejects it, deduplicates findings that share a root cause, and assigns a confidence score. The final call is yours: from the dashboard you can confirm a finding, mark it a false positive, accept the risk, mark it a duplicate, or mark it fixed. See Triage.
What happens to the sandbox after the run?
The platform destroys the sandbox when the assessment completes (or times out). No state persists between assessments. See Sandbox isolation.