> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/settings.md).

# Settings

Settings contains the controls that affect scan eligibility, scan behavior, access, integrations, and scope. Review these pages before your first scan.

<figure><img src="/files/QyIrVUgkbsPNP6VToILl" alt=""><figcaption></figcaption></figure>

## Usage

Open **Settings -> Usage** to check scan entitlement and current consumption.

Use this page to verify:

* available credits or scan-hour allowance;
* running and queued scan counts;
* plan or billing state;
* feature availability, such as internal assessment, scheduled scans, API/MCP access, reports, and attack paths;
* whether scan launch is blocked by missing domain setup, usage limits, feature access, or agent availability.

Credits are counted as worker runtime. Parallel workers may finish faster, but credit usage reflects the combined runtime of the workers.

## External

Open **Settings -> External** to set tenant-wide defaults for external scans. The page title is **External Assessment**.

Tenant-wide external controls include:

* severity display mode for external assessment findings;
* default attack vectors;
* custom headers;
* max module runtime, in seconds.

Severity display mode controls whether external assessment dashboards, finding lists, filters, and charts show the CVSS severity band or the Bugcrowd Vulnerability Rating Taxonomy priority.

* **CVSS** shows standards-aligned severity data derived from CVSS scoring. Choose it for compliance reporting, general remediation tracking, and teams that already triage by Critical/High/Medium/Low.
* **VRT** shows Bugcrowd-style P1-P5 priority data for web and API findings. Choose it when you want bug bounty style prioritization that maps findings to a shared web/app vulnerability taxonomy.

Learn more about Bugcrowd VRT: <https://bugcrowd.com/vulnerability-rating-taxonomy>

Rate limits, browser sessions, starting paths, trajectory scope, and browser behavior are configured per target from the External Discovery Phase or External Attack Phase settings drawer. Per-target settings can override tenant defaults for a specific run.

{% content-ref url="/pages/JqTFyGv6qHEq1MBlbEzs" %}
[Configure Scan Settings for External Assessment](/enterprise/how-to-trigger-an-external-scan/configure-scan-settings-for-external-assessment.md)
{% endcontent-ref %}

## Internal Assessment Settings

Internal assessment settings are configured in the launch flow, not from a separate Settings sidebar page.

Per-subnet controls such as allowed exploits, entity exclusions, agent assignment, PCE Intercept/Inveigh, RCE skip behavior, and runtime warnings are configured from **Modules -> Internal Assessment -> Attack Phase**.

## Domains

Open **Settings -> Domains** to manage external scope.

* **Whitelist** defines domains approved for external work.
* **Blacklist** blocks domains even if they are discovered through an approved root.

Blacklist takes precedence over whitelist.

{% content-ref url="/pages/0ajjGH6BFpdgg11q6axz" %}
[Domains](/enterprise/settings/domains.md)
{% endcontent-ref %}

## Domain Verification

Open **Settings -> Domain Verification** to prove DNS ownership of root domains before gated external workflows.

{% content-ref url="/pages/KbaSIgSbMUURkiHIWkMl" %}
[Domain Verification](/enterprise/settings/domain-verification.md)
{% endcontent-ref %}

## Trajectories

Open **Settings -> Trajectories** to create host/path rules for discovered API and browser flows.

Use these rules when your team wants to include or exclude specific endpoint paths across runs.

{% content-ref url="/pages/M0MfkR8EXMrAeSyOno1b" %}
[Trajectories](/enterprise/settings/trajectories.md)
{% endcontent-ref %}

## Agent

Open **Settings -> Agent** to download agent installers, view connection details, and manage agent runtime settings.

Use it to confirm:

* agent role, such as SANDBOX, CLOUD, or AGENT;
* connection status;
* public and private IPs;
* subnets and network interfaces;
* job-capacity settings when the agent exposes them.

{% content-ref url="/pages/qJVQdMWQN3SOOKDv02QD" %}
[Download Agent](/enterprise/download-agent.md)
{% endcontent-ref %}

## API Keys

Open **Settings -> API Keys + MCP** to create, rotate, or revoke API keys for REST and MCP clients.

API keys inherit the permissions and workspace/organization scope of the creating user. They cannot bypass scan launch policy.

{% content-ref url="/pages/630pgqCxCXa6IGmOxWjz" %}
[API Keys & MCP Server](/enterprise/settings/api-keys-and-mcp-server.md)
{% endcontent-ref %}

## Integrations

Open **Settings -> Integrations** to connect supported external systems. Availability depends on the deployment and feature flags.

Integration surfaces are tenant-gated. Connectors shown as **Coming soon** are visible in the UI but not active for the tenant.

## Email Identities

Open **Settings -> Email Identities** when browser-session recording needs controlled email addresses for OTPs, magic links, or account creation flows.

Plan email/phone routing during onboarding if target applications only allow approved domains or phone numbers.

## Users and Account

Use **Settings -> Users** and **Settings -> Account** to manage team access and account details. Confirm role assignments before giving users scan, report, API-key, or settings permissions.

## Debug and Preflight

Some deployments expose **Settings -> Debug** and **Settings -> Preflight Test**. Use these pages when you need deeper validation of scan readiness or runtime behavior.

Use preflight checks before high-stakes scans to validate queue health, job concurrency, connectivity, and crawler behavior.