Security & scope

Every pentest agent executes inside an isolated sandbox with controlled network egress. This makes the run safe against live and staging applications. In this service, AISafe never touches your source code.

Sandbox isolation

Each agent runs in a constrained execution environment:

• Isolated. The agent's environment shares no filesystem or memory with other sandboxes or the host.
• Controlled network access. For pentests, the sandbox reaches your target URLs, additional allowed domains, the hosts under any domain your organization verified and, when available, AISafe’s pinned callback server for out-of-band tests.
• Ephemeral. The platform destroys the sandbox when the assessment completes (or times out). No state persists between assessments.

Even if an agent misbehaves, it cannot cause harm outside its assigned task. See Sandbox isolation.

No source access

In the black-box pentest, AISafe accesses only the live behavior of your application. It does not receive or inspect your source code. For source-level analysis and its associated isolation, see Source Code Audit.

Controlled egress

AISafe's sandbox network policy prevents data exfiltration and limits how far any damage can spread:

• The sandbox reaches your target URLs, additional allowed domains and, when available, the pinned callback server.
• When your organization verified a domain such as example.com or app.example.com, the sandbox may also reach every host under it, so that a host your application calls, such as api.example.com under example.com or api.app.example.com under app.example.com, is tested too. See Hosts your application calls.
• A test user's OAuth token URL on another host, such as a sign-in provider's, is reached for the token request only, and is never tested.
• The platform blocks other hosts.
• You can add allowed domains if your application makes cross-origin requests.

The agent cannot reach unintended internal services or third-party systems.

Scope boundaries

The agent operates within the scope you define. Target traffic stays within your target URL paths, additional allowed domains and the hosts under your verified domains, with host and path exclusions taking precedence. When callback access is available, its traffic is captured and rate limited, and it connects only to the callback server’s pinned addresses on ports 80 and 443. See Prepare your target for the path and wildcard rules.

If the agent meets a redirect to a domain outside your configured scope, it does not follow it. This keeps the test in bounds even when the application links to external services.

The crawl also respects any excluded paths and rate limits you set, so you can shield sensitive endpoints and avoid destructive actions.

Credential handling

AISafe destroys the sandbox after the pentest completes. Captured traffic, finding evidence, reproduction steps, PoCs, reports and exports retain the actual credentials and tokens used against your target so you can reproduce findings. Use dedicated test accounts. Diagnostic logs and error reporting scrub secrets.

What this means for you

• Your source code never leaves your control and is not used by this service.
• Agents cannot reach your internal services during the pentest.
• The sandbox is destroyed; your captured evidence and findings remain available.
• Testing does not go beyond your scope, and this includes redirects to outside hosts.

AISafe cannot reach your internal network, does not follow redirects outside scope, and destroys every sandbox when the assessment finishes.