> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started: Penetration Tester

> Onboarding guide for Penetration Testers running autonomous AI pentests, validating findings, and gathering proof-of-concept evidence.

Snapsec empowers **Penetration Testers** by automating repetitive reconnaissance and vulnerability validation while providing deep control over assessment scope, methodologies, and evidence verification.

***

## 1. Scoping an Assessment

1. Navigate to **AI Pentesting > Projects & Assessments**.
2. Click **New Assessment** and choose the assessment type:
   * **External Perimeter**: Reconnaissance and exploitation against public IP/domain scopes.
   * **Web Application & API**: In-depth testing of authentication, business logic, injections, and CSRF/CORS.
   * **Internal Network**: Lateral movement and privilege escalation simulations.
3. Define the explicit scope: specify in-scope URLs/CIDRs and strict **out-of-scope targets**.

***

## 2. Safety Controls and Guardrails

To prevent unintended disruption to production workloads:

* Configure **Rate Limits**: Cap requests/sec (e.g., 20 req/s).
* Set **Exclusion Patterns**: Exclude destructive paths (e.g., `/admin/delete-database`, `/logout`).
* Enable **Human-in-the-Loop Mode**: Require analyst authorization before executing exploit payloads that modify state.

***

## 3. Reviewing Proof-of-Concept Evidence

Every finding generated by the AI Pentesting engine includes verifiable proof:

* Exact HTTP Request and Response headers and bodies.
* Command execution output or injected payload traces.
* Step-by-step reproduction guide so developers can reproduce the issue locally.

***

## 4. Automated Retesting

Once the engineering team submits a fix:

1. Open the assessment finding.
2. Click **Verify Fix (Retest)**.
3. The AI agent replays the exact test vector against the target and validates whether the vulnerability is remediated or still exploitable.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.