Skip to main content

Prepare your target

To run a pentest, you provide a target and the access the agents need to reach it. Everything stays within the scope you set.

Target URLs​

You give one to twenty-five base URLs for the application you want tested, for example https://staging.example.com. Each must be distinct: listing the same host twice does not test it twice, so we say so rather than quietly ignore the repeat. AISafe checks each URL before the run starts. An unreachable target stops the start with a clear message, and you are not charged. The assessment page then reads Start refused and names the target it could not reach, and it still says so when you come back to it. Fix the target and press Start again.

Authentication instructions​

Optional credentials or auth flow descriptions let the agent reach authenticated areas. Describe the login flow and provide test credentials if needed. Use a dedicated test account, not a real one.

Up to ten credentials, each with its own role. The role is how the agents tell your identities apart when they test whether one user can reach another user's data, so two credentials sharing a role are refused.

Custom headers​

Optional headers to include in all requests, for example an API key or a session token your application expects. Up to twenty, one entry per header name.

Rate limiting​

An optional requests-per-second cap to avoid overwhelming the target. Use this for production or shared staging environments.

Excluded paths​

Optional URL paths to skip during testing, up to one hundred. Use this to protect sensitive endpoints, avoid destructive actions, or stay within scope boundaries.

Reachability and scope​

The agents operate within the scope you define. Any URL outside the provided target URLs (and any additional allowed domains you configure) is unreachable from the sandbox. This keeps the test focused and stops the agent from wandering into areas you did not intend to test.

Two limits keep the run safe:

  • The sandbox egress is allowlisted. It reaches only the hosts you specify, and the platform blocks any host not in your allowlist.
  • If the agent meets a redirect to a domain outside your scope, it does not follow it. This keeps the test in bounds even when your application links to external services.

Because egress is allowlisted and redirects outside scope are not followed, the target must be reachable directly from the sandbox. Do not expect the agent to follow a chain that leaves your configured domains.

The check before you are charged​

When you press Start, AISafe requests each target from our network before it takes any payment. The check takes seconds and runs no analysis. If a target does not answer, the run does not start and no credits leave your balance.

If you set custom headers, the check sends them too. A target that answers 401 or 403 to a request carrying your headers stops the start as well, because the run would otherwise spend its budget against a login wall.

The message names the target, says what happened, and says what to check. Common causes:

  • A typo in the hostname, or a DNS record that is not public.
  • A firewall or IP allowlist that only admits addresses you know about.
  • A certificate that has expired or does not cover the hostname.
  • A header, cookie or token that has expired since you saved it.

If your target only accepts traffic from known addresses, email [email protected] with your assessment code. We will give you the addresses we test from and set it up with you.

Once you start​

The first stage validates the target and the authentication flow before any serious testing. A broken target or failed login stops the run early, with a clear message, instead of wasting time. See How it works.

Limits on what you send​

Every list on this page has a maximum length, and the entries have to be distinct. Going over either is refused with a clear message naming the limit — we never quietly trim a list to fit, because that would tell you we tested something we did not.

The limits bound what you send us, never what we give back. An assessment reports every finding it produced, however many that is.