Skip to main content

Prepare your target

To run a pentest, you provide a target and the access the agents need to reach it. Everything stays within the scope you set.

Target URLs​

You give one or more base URLs for the application you want tested, for example https://staging.example.com. AISafe validates each URL at the start of the run. An unreachable target halts the run with a clear message so you can fix it.

Authentication instructions​

Optional credentials or auth flow descriptions let the agent reach authenticated areas. Describe the login flow and provide test credentials if needed. Use a dedicated test account, not a real one.

Custom headers​

Optional headers to include in all requests, for example an API key or a session token your application expects.

Rate limiting​

An optional requests-per-second cap to avoid overwhelming the target. Use this for production or shared staging environments.

Excluded paths​

Optional URL paths to skip during testing. Use this to protect sensitive endpoints, avoid destructive actions, or stay within scope boundaries.

Reachability and scope​

The agents operate within the scope you define. Any URL outside the provided target URLs (and any additional allowed domains you configure) is unreachable from the sandbox. This keeps the test focused and stops the agent from wandering into areas you did not intend to test.

Two limits keep the run safe:

  • The sandbox egress is allowlisted. It reaches only the hosts you specify, and the platform blocks any host not in your allowlist.
  • If the agent meets a redirect to a domain outside your scope, it does not follow it. This keeps the test in bounds even when your application links to external services.

Because egress is allowlisted and redirects outside scope are not followed, the target must be reachable directly from the sandbox. Do not expect the agent to follow a chain that leaves your configured domains.

Once you start​

The first stage validates the target and the authentication flow before any serious testing. A broken target or failed login stops the run early, with a clear message, instead of wasting time. See How it works.