// security workers
Applications
An application Red Team run points a security agent at a running application. The agent drives a real browser against the application, probing for exploit paths the way an external attacker would: no source code, just the public surface. This is the black-box option.
Results stream to a live report page, and confirmed issues land in the Findings queue.
Start an Application run
- Open Red team and select New report, or go to
/app/reports/new. - Choose Application.
- Enter the target URL and any optional configuration below.
- Submit. The sandbox provisions and the run starts in the background.
| Field | Required | Notes |
|---|---|---|
| Target URL | Yes | Public HTTP or HTTPS URL. Localhost, private IPs, and metadata hostnames are rejected |
| Generated credentials | No | Login email and password for a test account, auto-generated and editable. Encrypted at rest and injected only into the sandbox |
| Headers | No | Up to 20 custom browser headers. Encrypted at rest, applied only to requests to the application's hosts |
| Request throttle | No | Cap requests between 1 and 600 per minute |
| Specific prompt | No | A per-report goal prompt, up to 8,000 characters |
| Additional files | No | Source archives, documents, or images for context. Dashboard only; not available through the API |
If your WAF would block the scanner, the dashboard shows a static egress IP to allowlist when one is configured for your deployment.
Scope and safety
The run is scoped to the target URL's host, including its www. variant and subdomains. Credentials, custom headers, and the throttle apply only to requests to those hosts, never to third-party origins. Credentials and headers are encrypted at rest and are never returned by the API.
Follow the run
Application red-team reports open at /app/reports/web-app/[id]. While the agent works you can watch:
- Logs: the live event feed of the agent's actions and reasoning
- Live browser: the browser session in real time, or the recording afterwards
- Evidence: recordings and screenshots captured during the run
- Findings: issues as they are confirmed, linked to the full finding page
From the report page you can Rerun the engagement or Delete the report.
Findings
Application findings appear in the Findings queue with kind web_app_red_team, alongside findings from repository reports and GitHub advisories. Triage and remediation work the same way for every kind.
API and MCP
POST /api/v1/reports/web-app starts a run programmatically with the same target, credential, header, throttle, and prompt fields, minus file attachments. The create_web_app_report MCP tool does the same from your coding agent. Both consume organization credits. See Reports API.