// red team
Web app reports
Browser-driven DAST against a live web application.
A Web app report points a security agent at a running application. The agent drives a real browser against your target, probing for exploit paths the way an external attacker would: no source code, just your public surface. This is the black-box option.
Results stream to a live report page, and confirmed issues land in the Findings queue.
Create a Web app report
- Open Red team and select New report, or go to
/app/reports/new. - Choose Web app.
- Enter the target URL and any optional configuration below.
- Submit. The sandbox provisions and the run starts in the background.
| Field | Required | Notes |
|---|---|---|
| Target URL | Yes | Public HTTP or HTTPS URL. Localhost, private IPs, and metadata hostnames are rejected |
| Generated credentials | No | Login email and password for a test account, auto-generated and editable. Encrypted at rest and injected only into the sandbox |
| Headers | No | Up to 20 custom browser headers. Encrypted at rest, applied only to requests to your target's hosts |
| Request throttle | No | Cap requests between 1 and 600 per minute |
| Specific prompt | No | A per-report goal prompt, up to 8,000 characters |
| Additional files | No | Source archives, documents, or images for context. Dashboard only; not available through the API |
If your WAF would block the scanner, the dashboard shows a static egress IP to allowlist when one is configured for your deployment.
Scope and safety
The run is scoped to the target URL's host, including its www. variant and subdomains. Credentials, custom headers, and the throttle apply only to requests to those hosts, never to third-party origins. Credentials and headers are encrypted at rest and are never returned by the API.
Follow the run
Web app reports open at /app/reports/web-app/[id]. While the agent works you can watch:
- Logs: the live event feed of the agent's actions and reasoning
- Live browser: the browser session in real time, or the recording afterwards
- Evidence: recordings and screenshots captured during the run
- Findings: issues as they are confirmed, linked to the full finding page
From the report page you can Rerun the engagement or Delete the report.
Findings
Web app findings appear in the Findings queue with kind web_app_red_team, alongside findings from repository reports and GitHub advisories. Triage and remediation work the same way for every kind.
API and MCP
POST /api/v1/reports/web-app starts a report programmatically with the same target, credential, header, throttle, and prompt fields, minus file attachments. The create_web_app_report MCP tool does the same from your coding agent. Both consume organization credits. See Reports API.