Troubleshooting
The most common blockers and their solution, from symptom to action: ownership proof, Guidance, launch, paused pentest, relay, payment, second factor, invitations and share links.
On this page
Each row starts from what you see in the application, gives the most probable cause and the action that unblocks it. The page that covers the topic is named under each table; the exact durations are gathered in Deadlines and expirations.
Domain ownership proof#
| Symptom | Probable cause | What to do |
|---|---|---|
| "Expired code" | The verification code is only valid for 72 hours. | Generate a new code, publish it, run the verification again. |
| "Redirection detected" (file) | The file is served behind a redirection, for example from http to https or to www. | Serve the file on the exact origin of the target, as a direct response. |
| "Resolvers disagree" (DNS) | The TXT record has not propagated yet, or not all your DNS servers publish it. | Wait for propagation to finish; if the zone is served by several providers, publish the record on all of them. |
| "Private address" | The target responds on a private IP address. | The target must respond on a public IPv4 address. |
| "Proof invalidated", or expired proof | The accepted proof is valid for 90 days; a domain change also invalidates it. An expired proof blocks any launch. | Create a new code and run the verification again. A reminder is sent 7 days before expiry. |
Details: Verify the domain.
Guidance#
| Symptom | Probable cause | What to do |
|---|---|---|
| The Guidance stays locked | The target's domain is not verified yet. | Complete the domain verification. |
| Publishing is refused | A field is empty or contains only spaces. | Fill in every field; start from a template (SaaS, e-commerce, API, website) if needed. |
| A path described in an API document is not tested | It points outside the authorised URLs: a document can never widen the scope. | Add the matching HTTPS URL in the target page, under the verified domain. |
Details: Write the Guidance.
Launching a pentest#
| Symptom | Probable cause | What to do |
|---|---|---|
| The launch is refused | At launch, SpectrAI rechecks the role, the available evaluation, the target, the freshness of the proof (under 5 minutes), the Guidance and the URLs. | Check each prerequisite: an available evaluation, a valid proof, an active Guidance, the administrator or member role. |
| No evaluation available | The evaluation of the one-off pentest is consumed, or the second evaluation of the annual programme is not open yet. | Order an evaluation from the application page. A retest consumes no evaluation. |
| The pentest waits without starting | The platform runs pentests one after the other: yours waits its turn. The chosen start window may also not be open. | Wait; the pentest page shows its phase. |
| A scheduled pentest is paused | No evaluation available, expired ownership proof, missing Guidance or authorisation no longer valid. | Fix the condition named in the notification (renew the proof, publish the Guidance, order an evaluation), then launch again. |
Details: Launch a pentest.
Relay and internal scans#
| Symptom | Probable cause | What to do |
|---|---|---|
| "Internal application" unavailable when creating a target | Internal scans are not enabled on your space. | Write to us from the contact page. |
| No ready agent | An agent is ready when it has connected within the last 90 seconds: the machine is off, the container is stopped, or outbound HTTPS to the gateway is blocked. | Check that the machine is on and the container is running, read its logs, or enrol a new agent. |
| The enrolment code is refused | The token is single-use, shown only once, and expires after 15 minutes. | Generate a new token and new commands. |
| No test goes through the site | No current mandate: without a testing authorisation, nothing goes through the site. | Grant or renew the mandate. |
| Reachability "unreachable", "refused" or "expired" | The agent could not open the requested TCP connection, or the address is not covered by the mandate. | Check network access from the agent's machine and the coverage of the mandate; the explanation of the result stays in the site's history. |
| The agent disconnected during a scan | Relay loss. | Partial results are kept; the resume is offered once the agent is back, without an additional evaluation. |
Details: Install the relay and The testing mandate.
Ordering and payment#
| Symptom | Probable cause | What to do |
|---|---|---|
| Rights do not open after payment | The payment confirmation and its reconciliation open the rights, usually within a few minutes. | Choose Refresh the payment. |
| The payment page expired or the payment failed | The attempt is not complete. | Resume the payment reopens the same attempt, without a duplicate; Cancel before payment withdraws the order. |
| The terms of use are refused | The version you read is outdated. | Reload the page and read them again. |
| The order disappeared | A pending order abandoned for thirty days is cancelled on its own. | Order an evaluation again. |
| Launches are suspended | An instalment unpaid after the grace period, a dispute or a refund places the contract in verification. | Settle the instalment from the invoice list; a SpectrAI operator resolves a dispute with a justification. |
Details: Ordering an evaluation.
Results and retests#
| Symptom | Probable cause | What to do |
|---|---|---|
| An expected finding does not appear | Only weaknesses demonstrated with evidence are published. | A report without findings attests that no weakness was proven within the scope and time of the test. Refine the Guidance (roles, high-impact flows) for the next pentest. |
| The retest says "not reproduced" | The targeted test did not find the original finding again: the result is inconclusive. | It does not prove that the fix is correct; no "fix verified" verdict exists. |
| A retest batch cannot be prepared | Both batches are used up, or the sixty-day window is closed. | A new order is required. |
| The share link no longer opens | The link expired on the chosen date, or was revoked. | Create a new link from the report. |
Details: Correction retests and The report.
Account and team#
| Symptom | Probable cause | What to do |
|---|---|---|
| The e-mail code is refused | The code is valid for 10 minutes and 5 attempts. | Request a new code: one per minute, six per hour. |
| An action asks for a "verified session" | Adding a site, an agent or a testing authorisation requires a second factor in the current session. | Sign in again with your second factor; a password reset does not count as a verified session. |
| The invitation no longer works | It expired on the date displayed. | Ask an administrator to send an invitation again. |
| You cannot change your own role | Nobody can change their own role. | Ask another administrator of the space. |
Details: Sign-in and second factor and Team and roles.
Nothing matches#
Write to us from the contact page, naming the page concerned and what you see; we reply by email. The capabilities the product lacks are listed in Limits and commitments, the common questions in the FAQ.