Assessment setup guides a project through eight steps for a reviewed network target or a repository-bound source analysis. Saving records the setup; it does not start a scan.
1. Pentest Target
Choose Web application, API endpoint, Mobile backend, or AI capability endpoint. The step also offers Website registration and review plus GitHub or GitLab repository connection.
2. Scope
Choose a reviewed network origin or a repository revision. For a network target, enter the origin and environment, then select an active reviewed authorization and included scope policy. This step uses existing authorization and scope.
3. Test Users
Add optional named identity references for a network assessment, one name and principal per line. Credentials can be attached separately after saving when the credential vault is configured; the current standard DAST runner does not yet hydrate them into requests. For a repository-only assessment, the step explains that test identities apply to network assessments only.
4. Allowed Domains
Review the proposed origin, passively observed domain candidates, and optional excluded origins. The step does not discover or authorize additional domains. Repository-only assessments have no attackable domains.
5. Code & Documentation
For a network binding, review the target origin, test-user references, and request limits. It does not attach a repository revision. For a repository binding, choose a project repository and its exact commit revision.
6. Safety Check
Name the assessment and set the requested request rate and maximum request count for a network binding. Repository-only analysis does not send HTTP requests. The setup requests safe mode and keeps redirects off.
7. Cost & execution
Review the displayed save and run status, then choose Manual only, Fixed interval, or Daily. Saving records the cadence, but recurring execution stays disabled until you explicitly enable it.
8. Summary
Review the assessment binding and summary, then choose Save assessment setup. Saving records the definition only. A separate run action starts a network assessment or source analysis after the required checks.
Where do you review the run?
The Review desk shows recent run state in its Assessment journal. Open Scan journal for the project’s scan list and status.
Open Findings register to review results and inspect linked HTTP Records. Review OAST Interactions under Out-of-band callbacks when the assessment produced callback evidence.
Which guide should you read next?
See Projects and scans for repeatable assessment workflows, Authenticated testing for protected routes, or Agent-assisted follow-up for contextual investigation.
For scope and replay guidance, read Run your first assessment.