> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/modules.md).

# Modules

Modules are the pages where operators configure and run discovery, assessment, and result-review workflows.

## External Assessment

| Page                | Use for                                                                         |
| ------------------- | ------------------------------------------------------------------------------- |
| **Discovery Phase** | Map domains, web pages, APIs, services, and trajectories before active testing. |
| **Attack Phase**    | Run external vulnerability testing against selected targets.                    |
| **Statistics**      | Review aggregate external results.                                              |
| **Attack Paths**    | Triage external findings and retest.                                            |

## Internal Assessment

| Page                | Use for                                                                       |
| ------------------- | ----------------------------------------------------------------------------- |
| **Discovery Phase** | Discover internal hosts and services through a connected local agent.         |
| **Attack Phase**    | Run internal assessment on selected subnets with per-subnet exploit controls. |
| **Statistics**      | Review aggregate internal results.                                            |
| **Attack Paths**    | Triage internal findings and retest.                                          |

## Code Assessment

| Page             | Use for                                                                                                          |
| ---------------- | ---------------------------------------------------------------------------------------------------------------- |
| **Repositories** | Select GitHub repositories, run manual assessments, schedule assessments, and open per-repository scan settings. |
| **Statistics**   | Review aggregate code assessment findings by severity, category, repository, and trend.                          |
| **Attack Paths** | Triage confirmed source-code, dependency, secret, authorization, and business-logic findings.                    |
| **SBOM**         | Review AI-BOM and SBOM verification, then download SPDX, CycloneDX, and AI-BOM exports.                          |

## Other Module Areas

The sidebar can include credential-compromise modules, custom modules, and test/debug modules when those features are enabled for the tenant. Use those only when they are part of the approved engagement.

## Before Running Any Module

Check:

* target scope is approved;
* required agents are connected, or the GitHub App is connected for code assessment;
* scan configuration is saved;
* branch or commit selection is intentional for code assessment;
* estimates and runtime warnings are acceptable;
* schedules are created from the final run review and reference the intended saved settings;
* destructive internal categories are approved.

Existing schedules are reviewed and deleted from **Activity -> Schedule**.