Auto-pentest

Goal and authorization

Auto-pentest performs an authorized active web assessment for exactly one linked website and connects confirmed evidence to provider follow-up. Enable it only when you own the target or have written authorization to test it. Consent for one URL does not extend to another subdomain, tenant, redirect host, third-party service, or unrelated IP.

If the task has no single exact linked target, active probing does not start. Old reports, provider comments, or shared artifacts can never substitute for current product consent.

What the run tests

Guard combines repository context with target-specific active exploration. It maps public workflows and attack surfaces, uses relevant open-source tools when safe, and manually rechecks important tool signals. Testing stays on the exact target and uses the minimum non-destructive proof needed to establish impact.

The run forbids denial of service, load or resource-exhaustion testing, spam, persistence, backdoors, lateral movement, credential theft, social engineering, destructive data changes, and real-user-data exfiltration. It does not intentionally degrade production availability or self-register production accounts unless the task explicitly permits that access path.

Findings and provider outcome

Confirmed findings are deduplicated against open and closed issues and review requests. In issue mode, Guard creates, reuses, or comments on one primary-risk issue and opens no PR/MR. In PR mode, the highest-risk provider action and the safest autonomous fix can be different: the serious finding still receives issue visibility while a separate bounded defensive candidate may become the review request.

The report keeps the broader finding set visible even when only one item receives provider action.

Safe-fix boundary

A review request is allowed only for a small defensive change with a relevant repository check that passes after the edit. If the change needs a human decision, expands beyond target scope, lacks reliable verification, or could affect product behavior unsafely, Guard leaves an issue or comment with the no-PR reason. It never merges.

Outcomes and next steps

Outcomes include no confirmed finding, target unavailable, access or geo limitation, issue/comment only, or issue/comment plus a linked review request. Read the exact target, repository revision, evidence, limitations, and provider outcome in the report. After any fix lands, rerun the appropriate security audit and, when still authorized, the bounded target check.

See Configure Auto-pentest and Active-testing consent before enabling a run.