How do I keep testing safe on a production app?

Steps

1. Create the target with the right Environment. Prefer a staging copy for the first full run.
2. Open the profile. In Scope, untick Run exploitation phase if live requests are too risky. With it off, the scan only reads source code.
3. Under Avoid rules, click + Add rule. Pick a type such as Url Path, Method or Parameter and enter the value to skip.
4. Open Reporting. In Rules of engagement, write plain limits, for example to avoid destructive payloads in production.
5. In Authentication, add a role with the lowest Privilege level that still reaches the pages you need. Use a dedicated test account, never a real customer login.
6. Click Preview YAML to check the settings, then Save.

Good to know

Authorise first. Only scan applications you own or have written permission to test. Tell the people who run the app before the first run.

Rules of engagement guide the agents in words. Avoid rules narrow the scope. Use both. Detected personal data in the free-text fields is redacted before analysis, while IPs and URLs stay.

When the exploitation phase is on, the agents send real requests and use a real browser, so a production run changes more than a source-only run. Start small, then widen. You can schedule a run for a quiet hour with a recurring schedule. See how to add rules of engagement for the field details.

Related questions

• How do I stop a scan from testing a certain HTTP method?
• How do I turn off the exploitation phase?
• How do I add rules of engagement, such as no destructive payloads in production?
• How do I exclude a URL path or subdomain from a scan?
• How do I mark a target as Dev, Staging or Prod?

Full tutorial

How to set focus and avoid rules on a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre