During the test
What happens on your application during a SpectrAI pentest: real traffic, test data, alerts, firewalls and CDNs, the recommended environment, prohibited techniques and what the guardrails do or do not guarantee.
Real traffic on your application#
The agents send real HTTP(S) requests to the authorised URLs, with the test accounts provided: navigation, forms, APIs, chains of actions. A test may therefore:
- create or modify test data (accounts, records, files);
- trigger the alerts of your security tools and fill your logs;
- temporarily slow the application down.
That is the subject of the attestation accepted at launch, and the reason recent backups must exist.
Choosing the environment#
An isolated staging environment, filled with test data, is recommended: it avoids side effects on your real data and your customers. If you test production, enable the careful mode in the pentest's guardrails (read operations and test data preferred; changes remain possible) and keep flows that send real messages or payments out of the test by placing them in the exclusions and in the Guidance's prohibited techniques.
Web application firewall, CDN and rate limiting#
Upstream protections (web application firewall, CDN, anti-bot, rate limiting) see test traffic as attack traffic. They may block the agents, and the report then only covers what was reached. Before launching:
- obtain the agreement of the third parties concerned and respect their testing rules (one of the points of the attestation);
- if your application filters by IP address or firewall rule, write to us from the contact page before the launch to agree on the passage;
- state the protections in place in the Guidance: the agents take them into account.
The maximum requested rate (1 to 50 requests per second) is a test instruction; it is not guaranteed at the network level.
Prohibited techniques#
The Guidance carries a list of prohibited techniques, prefilled with: denial of service, data deletion, sending real messages or payments, accessing third-party services outside the scope. Complete it for your context. The agents respect it as an instruction; the network confinement remains that of the authorised scope.
What the platform bounds#
| Element | Nature |
|---|---|
| Scope | The authorised URLs externally, the mandate internally: a destination outside the scope is refused before being contacted. |
| Start window | Enforced by the platform: the pentest only starts within the chosen days and hours. |
| Duration and consumption | Internal limits managed by SpectrAI; the pentest page shows the latest end time. |
| Excluded paths, rate, careful mode | Test instructions, with no network block. |
Test accounts during the run#
Test accounts travel in clear text through the test engine and the model that drives it during the run, then are redacted from the evidence and purged. Revoke them after the test.
Stopping a test#
You can cancel a pentest at any time from its page; the evaluation is returned only if it had not yet effectively started. An internal site can also revoke its mandate, which stops the tests running on that site without publishing their results.
What SpectrAI does not do#
- No public list of source IP addresses is provided: agree on the passage with us if you filter by address.
- No promise of exhaustive coverage or absence of false positives: only demonstrated weaknesses are published, and a retest does not verify a fix.