Best Practices

Get more signal and less friction from every scan.

Get more signal and less friction from every scan.

Start with authorization and scope

• Test only what you own or are explicitly authorized to test, and keep that authorization in writing.
• Register each target and write rules of engagement before the first scan. Name what is in scope, what is off limits and what actions are forbidden.
• Agree testing windows with the owners of shared infrastructure, such as hosting providers and third-party APIs.

Test the right environment

• Start on staging. Move to production once scope and rate limits are proven.
• Use realistic data in staging so business-logic flaws can surface, and keep real customer data out of it.
• For production, set Max requests per second and use Avoid patterns for fragile or destructive paths.

Pick the right depth

Start shallow and go deeper where the results justify it. See Scan Modes.

Give agents access

Most serious bugs sit behind a login. Authenticated scans find far more than unauthenticated ones.

• Create dedicated test accounts for each role you want covered, such as user, manager and admin.
• Store credentials in the Secrets Vault rather than typing them into forms.
• If the app uses two-factor authentication, provide the TOTP secret for the test account.
• Describe your application: what it does, its most sensitive flows and its user roles. Context lets agents prioritize.

Manage cost

• Use fast models for Quick and Standard scans, and flagships for deep assessments.
• Use Retest on a single finding to confirm a fix instead of re-running a full scan.
• Set Max iterations to put a ceiling on a scan.
• Keep an eye on your balance in the sidebar. Scans pause, not fail, when it runs out.

Make findings actionable

1. Triage new findings the same day, and assign an owner.
2. Connect Jira so tickets are created with proof of concept and remediation included.
3. Fix, then retest to close each issue with evidence.
4. Use the Attack Chain view to decide which fix removes the most risk.

Build it into your process

• Schedule recurring scans on key targets from the Calendar.
• Trigger scans from CI with an API key after each release to staging.
• Send alerts to Slack or Microsoft Teams so the right people see critical findings immediately.
• Generate an Executive report for stakeholders and a Penetration Test report for engineers from the same scan.

Keep your account safe

• Turn on two-factor authentication for every user.
• Give API keys only the permissions a script needs, and rotate them regularly.
• Remove access for people who leave the team.