Settings

Configure tenant, scan, access, agent, integration, and scope settings.

Settings contains the controls that affect scan eligibility, scan behavior, access, integrations, and scope. Review these pages before your first scan.

Usage

Open Settings -> Usage to check scan entitlement and current consumption.

Use this page to verify:

• available credits or scan-hour allowance;

• running and queued scan counts;

• plan or billing state;

• feature availability, such as internal assessment, scheduled scans, API/MCP access, reports, and attack paths;

• whether scan launch is blocked by missing domain setup, usage limits, feature access, or agent availability.

Credits are counted as worker runtime. Parallel workers may finish faster, but credit usage reflects the combined runtime of the workers.

External

Open Settings -> External to set tenant-wide defaults for external scans. The page title is External Assessment.

Tenant-wide external controls include:

• severity display mode for external assessment findings;

• default attack vectors;

• custom headers;

• max module runtime, in seconds.

Severity display mode controls whether external assessment dashboards, finding lists, filters, and charts show the CVSS severity band or the Bugcrowd Vulnerability Rating Taxonomy priority.

• CVSS shows standards-aligned severity data derived from CVSS scoring. Choose it for compliance reporting, general remediation tracking, and teams that already triage by Critical/High/Medium/Low.

• VRT shows Bugcrowd-style P1-P5 priority data for web and API findings. Choose it when you want bug bounty style prioritization that maps findings to a shared web/app vulnerability taxonomy.

Learn more about Bugcrowd VRT: https://bugcrowd.com/vulnerability-rating-taxonomy

Rate limits, browser sessions, starting paths, trajectory scope, and browser behavior are configured per target from the External Discovery Phase or External Attack Phase settings drawer. Per-target settings can override tenant defaults for a specific run.

Configure Scan Settings for External Assessment

Internal Assessment Settings

Internal assessment settings are configured in the launch flow, not from a separate Settings sidebar page.

Per-subnet controls such as allowed exploits, entity exclusions, agent assignment, PCE Intercept/Inveigh, RCE skip behavior, and runtime warnings are configured from Modules -> Internal Assessment -> Attack Phase.

Domains

Open Settings -> Domains to manage external scope.

• Whitelist defines domains approved for external work.

• Blacklist blocks domains even if they are discovered through an approved root.

Blacklist takes precedence over whitelist.

Domains

Domain Verification

Open Settings -> Domain Verification to prove DNS ownership of root domains before gated external workflows.

Domain Verification

Trajectories

Open Settings -> Trajectories to create host/path rules for discovered API and browser flows.

Use these rules when your team wants to include or exclude specific endpoint paths across runs.

Trajectories

Agent

Open Settings -> Agent to download agent installers, view connection details, and manage agent runtime settings.

Use it to confirm:

• agent role, such as SANDBOX, CLOUD, or AGENT;

• connection status;

• public and private IPs;

• subnets and network interfaces;

• job-capacity settings when the agent exposes them.

Download Agent

API Keys

Open Settings -> API Keys + MCP to create, rotate, or revoke API keys for REST and MCP clients.

API keys inherit the permissions and workspace/organization scope of the creating user. They cannot bypass scan launch policy.

API Keys & MCP Server

Integrations

Open Settings -> Integrations to connect supported external systems. Availability depends on the deployment and feature flags.

Integration surfaces are tenant-gated. Connectors shown as Coming soon are visible in the UI but not active for the tenant.

Email Identities

Open Settings -> Email Identities when browser-session recording needs controlled email addresses for OTPs, magic links, or account creation flows.

Plan email/phone routing during onboarding if target applications only allow approved domains or phone numbers.

Users and Account

Use Settings -> Users and Settings -> Account to manage team access and account details. Confirm role assignments before giving users scan, report, API-key, or settings permissions.

Debug and Preflight

Some deployments expose Settings -> Debug and Settings -> Preflight Test. Use these pages when you need deeper validation of scan readiness or runtime behavior.

Use preflight checks before high-stakes scans to validate queue health, job concurrency, connectivity, and crawler behavior.