Active testing consent

What consent authorizes

Active-testing consent authorizes Guard to send bounded security-testing requests to exactly one linked website on behalf of someone who owns the target or has written permission to test it. Repository access, an earlier audit, or a prior issue does not imply this consent.

The task’s current Linked websites target is authoritative. Consent for https://app.example.com does not automatically include another subdomain, tenant, redirect destination, third-party service, or IP.

Confirm before enabling

Verify the full scheme and hostname, environment, ownership or written authorization, expected traffic sensitivity, provider repository linked to the target, and who will review findings. If the target is production, consider logs, alerts, rate limits, test-account policy, and the smallest useful testing window.

Auto-pentest can create traffic, logs, temporary application effects, and third-party alerts. If those effects are not acceptable, do not enable it until the owner provides a safer environment or explicit constraints.

Non-destructive testing boundary

Guard must not perform denial of service, load or resource-exhaustion tests, spam, persistence, backdoors, lateral movement, credential theft, social engineering, destructive data changes, or real-user-data exfiltration. It must not intentionally degrade availability or self-register production accounts unless the task explicitly authorizes that access path.

Proof should use the least invasive evidence available: code context, a harmless request/response difference, a redacted excerpt, a controlled test account, or another narrowly scoped non-mutating request. When stronger proof could cause harm, the report keeps the claim limited instead of escalating.

Missing or changed scope

If there is no single unambiguous linked target, active probing does not run. Redirects outside scope are not followed as new targets. A host ownership transfer, environment change, new tenant, or changed URL requires a fresh authorization review before the next run.

Historical reports and provider comments can guide duplicate handling, but they cannot grant consent for a new target.

Provider actions are separate

Consent to test does not automatically authorize code writes. Issue mode can create, reuse, or comment on a primary-risk issue. Safe-fix mode can open a linked review request only for a small defensive change with credible repository verification. Guard never merges it.

Revoke or pause consent

Disable the Auto-pentest job or schedule before consent expires, ownership changes, or the target becomes unsuitable for testing. Review linked websites and write behavior when re-enabling. Revoking active testing does not delete completed reports or provider artifacts; handle those separately according to their retention and visibility controls.