> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Probe a live application with browser-driven DAST and review evidence as findings land.

# Applications

An application Red Team run points a security agent at a running application. The
agent drives a real browser against the application, probing for exploit paths
the way an external attacker would: no source code, just the public surface.
This is the black-box option.

Results stream to a live report page, and confirmed issues land in the [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue.

### Start an Application run

1. Open **Red team** and select **New report**, or go to `/app/reports/new`.
2. Choose **Application**.
3. Enter the target URL and any optional configuration below.
4. Submit. The sandbox provisions and the run starts in the background.

| Field | Required | Notes |
| --- | --- | --- |
| Target URL | Yes | Public HTTP or HTTPS URL. Localhost, private IPs, and metadata hostnames are rejected |
| Generated credentials | No | Login email and password for a test account, auto-generated and editable. Encrypted at rest and injected only into the sandbox |
| Headers | No | Up to 20 custom browser headers. Encrypted at rest, applied only to requests to the application's hosts |
| Request throttle | No | Cap requests between 1 and 600 per minute |
| Specific prompt | No | A per-report goal prompt, up to 8,000 characters |
| Additional files | No | Source archives, documents, or images for context. Dashboard only; not available through the API |

If your WAF would block the scanner, the dashboard shows a static egress IP to allowlist when one is configured for your deployment.

### Scope and safety

The run is scoped to the target URL's host, including its `www.` variant and subdomains. Credentials, custom headers, and the throttle apply only to requests to those hosts, never to third-party origins. Credentials and headers are encrypted at rest and are never returned by the API.

### Follow the run

Application red-team reports open at `/app/reports/web-app/[id]`. While the agent works you can watch:

- **Logs**: the live event feed of the agent's actions and reasoning
- **Live browser**: the browser session in real time, or the recording afterwards
- **Evidence**: recordings and screenshots captured during the run
- **Findings**: issues as they are confirmed, linked to the full finding page

From the report page you can **Rerun** the engagement or **Delete** the report.

### Findings

Application findings appear in the [Findings](https://www.superagent.sh/docs/concepts/findings-and-reports) queue with kind `web_app_red_team`, alongside findings from repository reports and GitHub advisories. Triage and remediation work the same way for every kind.

### API and MCP

`POST /api/v1/reports/web-app` starts a run programmatically with the same target, credential, header, throttle, and prompt fields, minus file attachments. The `create_web_app_report` [MCP tool](https://www.superagent.sh/docs/mcp) does the same from your coding agent. Both consume organization credits. See [Reports API](https://www.superagent.sh/docs/api/reports).

## Next steps

- [Review findings and reports](https://www.superagent.sh/docs/concepts/findings-and-reports)
- [Start runs with the Reports API](https://www.superagent.sh/docs/api/reports)
- [Subscribe to report events with Webhooks](https://www.superagent.sh/docs/webhooks)

---
Source: https://www.superagent.sh/docs/security-workers/red-team/applications
Index: https://www.superagent.sh/llms.txt