Red Team
Self-serve red teaming against what you actually run: your app, repo, agents, and models.
Scanners tell you about known CVEs. Red Team tells you how an attacker would actually break what you built. Superagent runs adversarial campaigns against your real surface: black-box against public Web apps, gray-box with repository context. Every finding ships with repro steps and the payload that worked, ranked by severity against your architecture rather than a generic checklist.
All reports live under Red team in the dashboard, in one list across every target type.
Pick a target
| Target | What it tests | Access needed |
|---|---|---|
| Repository | A GitHub codebase, scanned for vulnerabilities, unsafe patterns, and config issues | Superagent Security installed on the repo |
| Web app | A live Web application, probed by browser-driven DAST | A public HTTP or HTTPS URL |
| Agent | An AI system in production, tested for jailbreaks, policy gaps, and unsafe behavior | A description of the system under test |
| Model | A model, probed across attack categories like jailbreaks and prompt injections | Rolling out; shown as "Coming soon" in the dashboard |
Create a report
Start from Red team → New report (/app/reports/new), pick a target type, and fill in the details. Reports run asynchronously in an isolated sandbox, so creation returns immediately and the run proceeds in the background.
You can also start repository and Web app reports from the Reports API or the MCP server. Both consume organization credits.
Follow the run
Each report has a detail page with a live event feed, sandbox status, and results as they land. Repository reports can also trigger automatically on a GitHub release, a tag, or a schedule instead of manual creation.
Report lifecycle:
| Status | Meaning |
|---|---|
| In progress | Sandbox is provisioning or the agent is running |
| In review | The run finished and results are ready for your review |
| Done | Reviewed and closed |
| Failed | Provisioning or execution failed, with safe error context |
Subscribe to report.started and report.finished webhooks to drive your own workflows from the lifecycle.
From report to fix
Findings from repository and Web app reports land in the Findings queue with repro context. Automated triage verifies them, and confirmed findings can become fix PRs without leaving the queue.