Surfaces AppSec actually runs, in one Workbench.
Scanning and triage happen in Workbench and through the API. Each surface writes into the same project, evidence, and administration model.
DAST
Run authorized web and API assessments.
Start from an approved target and keep scope, authentication, findings, HTTP records, and OAST callbacks in the project that owns the assessment.
- Inputs: Approved URL, URL list, cURL input, captured request and response, OpenAPI definition, or Postman collection.
- Review evidence: Findings retain the HTTP records and OAST callbacks collected during the assessment when those records are available.
- Availability: Professional and higher
SAST
Review an authorized source snapshot.
Clone an approved repository or upload source in Workbench. Source analysis stays separate from live-target DAST and returns reviewable locations from the pinned source snapshot.
- Inputs: Credential-free HTTPS repository URL, connected repository source, or uploaded source archive.
- Review evidence: Candidates cite a file, line, and source snippet before they enter review.
- Availability: Professional and higher
SCA
Inventory dependencies from the source you provide.
Dependency review starts from the project source and its manifests or lockfiles. Its results remain in the same project inventory as other assessment findings.
- Inputs: Project source with dependency manifests and lockfiles.
- Review evidence: Review the affected component and associated finding in Workbench before exporting a result.
- Availability: Professional and higher
IaC
Review infrastructure and CI definitions in project source.
Infrastructure-as-code checks run against the configuration files you include in the authorized source snapshot, not a disconnected infrastructure account.
- Inputs: Infrastructure and CI configuration files included in the project source.
- Review evidence: A configuration finding remains tied to the project and source context used for its review.
- Availability: Professional and higher
Secrets
Detect credentials and tokens in project artifacts.
Secrets detection reviews the code and artifacts you bring into the authorized project. It is not a claim that every credential is valid or that every secret should be exposed in the UI.
- Inputs: Authorized code, configuration, and project artifacts.
- Review evidence: Use the finding inventory to triage the location and remediation context without treating a label alone as proof of impact.
- Availability: Professional and higher
Agent
Use bounded agent-assisted follow-up inside an authorized project.
Agent-assisted work does not replace native modules or operator review. It stays in the project authorization boundary and writes promoted findings into the same review trail.
- Inputs: An authorized project, its approved target or source, and the workspace feature entitlement.
- Review evidence: Promoted findings still require reviewable evidence from concrete assessment work.
- Availability: Business and higher
