How to move from approved scope to reviewable evidence.

Choose the task in front of you. Each guide names the Workbench screen, the safety boundary, and the evidence to inspect before moving on.

  • Workbench Assessment setup at step 1: Select pentest target

    How to use Guard

    Choose the project and authorized target in Assessment setup. Saving the setup does not start a scan.

    Open the guide
  • Current Workbench Engine configuration page with masked sensitive values

    Review engine configuration

    Open Administration, then Engine configuration. Viewers can read entries; only a platform operator can write them.

    Open the guide
  • Workbench Findings register with status filters and grouped findings

    Review findings during a bug bounty

    Filter findings by status in Findings register, then inspect each finding with its supporting evidence.

    Open the guide
  • Current Repositories page before any source repository is connected

    Connect source repositories

    Connect GitHub or GitLab, then add a repository in Repositories. Select a connected source in the Code & Documentation step of Assessment setup.

    Open the guide
  • Workbench Assessment setup at step 1: Select pentest target

    Set up an authorized assessment

    Choose the project and target, define scope and safety bounds, then save the assessment setup. Saving does not start a scan.

    Open the guide
  • Workbench Assessment setup on step 3, Test Users

    Add test users for authenticated testing

    Record optional identity references for the roles under test in the Test Users step.

    Open the guide
  • Go SAST finding for sqreen/go-dvwa with its original source and sink evidence

    Review a finding before export

    This real Go SAST example shows source and sink excerpts. HTTP evidence is only available when captured separately.

    Open the guide
  • Workbench OAST Interactions page showing callback protocols, target URLs, injection types, and times

    Review OAST Interactions

    Review protocol, target URL, injection type, and interaction time in OAST Interactions.

    Open the guide