Configure a pentest

Setting up a pentest takes four short steps: Target, Access, Scope and Review. You can save a draft at any point on the Target step and finish later.

Before you start

Have the URL of your app ready. If the app has a login, create one test account per role you want tested (for example admin and regular user). If you want a whitebox pentest, have your source code or a GitHub repository ready.

Open the setup

Click New pentest in the sidebar (or on the Assets page). If you already have apps in SQUR, pick one to reuse its setup, or paste a new URL. With no apps yet, you go straight to step 1.

An app you have tested before offers two choices: Retest (keeps the saved setup) or New pentest (updates the saved scope and test accounts).

1. Target

1. Enter the URL of the app you want tested.
2. Choose how often: Run once (one full pentest, results in 24 hours, one free retest after you fix) or Run continuously (a full pentest every month with unlimited free retests and a living certificate). Current prices are on squr.ai/pricing.
3. Click Continue. Save as draft keeps your entries without starting anything.

If the host does not resolve in public DNS, SQUR tells you here so you can fix a typo before going further.

2. Access: who do we sign in as?

Most risk sits behind the login, so SQUR asks you to decide this explicitly.

• Add a test account for each role. Give it a role name, and optionally the login URL, a verification URL (a page that only shows after login) and notes.
• Accounts that receive a one-time code by email (as 2FA or as a passwordless login) can use a SQUR inbox address: SQUR gives you an address to create the user with and reads the code itself.
• No login at all? Tick This is a public site, no sign-in.

Credentials are used only to let the agent log in during pentests. Continue unlocks once you have a complete test account or have marked the site public. Not the right person to hold the credentials? Use Invite teammate to let a colleague finish this step.

3. Scope: what is in bounds?

1. Click Find scope. SQUR discovers the other hosts your app uses (APIs, backends) and sorts them for you.
2. Set each host to one of three rules:

Rule	Meaning
Test	SQUR attacks it.
Pass through	SQUR can reach it but never attacks it.
Ignore	Not touched at all.

Your own app is always in Test. Exclude anything fragile or out of bounds by setting it to Ignore.

Add source code for a whitebox pentest (optional)

The Source code card turns a black-box pentest into a whitebox one: SQUR tests the live app and reads your code alongside it. Where the code points to a weakness, SQUR tries it against the live app. Two ways to provide it:

• Connect a GitHub repository. Choose Connect GitHub, pick the repository and branch, and optionally include or exclude folders. SQUR reads repository contents only, and only for the repositories you pick. If you are not the GitHub owner, send the install link to the person who is. The branch is checked at every launch.
• Upload a .zip. Drop a zip of your repository. SQUR checks it in your browser first and leaves out anything that is not source or text, such as dependencies, build output, images and likely secrets.

The source is saved on the app, so every later pentest of it uses it, including scheduled ones. Replace or remove it in the app's settings.

More context (optional)

• API spec: upload an OpenAPI/Swagger spec or protobuf for deeper API coverage. SQUR tests every documented endpoint.
• Reference URLs and documentation: API docs, runbooks, or a short description of what the app does and which flows matter.
• Focus for this run: for example "focus on authentication and payment flows".
• Pentest name: to keep your assessments organized.

4. Review and launch

The Review step reads everything back: target, pentest type (Black-box or Whitebox), cadence, test accounts and the rules per host.

1. Tick Authorization to test. It names the in-scope targets and accepts the Terms of Engagement. This is the single consent step; there is no separate consent dialog afterwards.
2. Click Launch pentest (or Launch whitebox pentest, or Set up continuous testing for a subscription). Without enough credits, the button buys and launches in one flow.

If Launch is disabled, a line below it says what is still missing. Save & finish later keeps a draft of a one-time pentest (not for continuous testing, which is a subscription).

Not sure about scope or access?

The setup page offers a free 15-minute call with an offensive security engineer. You go through scope and access together and can launch on the call.

---

Success checklist

• The pentest appears under Assets with a run in progress.
• You receive an email when it starts. Results arrive in about 24 hours.
• Findings appear on the run page and in Findings as the agent confirms them.

Next steps

• Follow the live pentest
• Stop or abort a run