What does 'pending review' mean?

The automated pass is done and a security researcher is verifying each finding by hand and probing deeper. Findings are preliminary until the review finishes; more may be added, some may be removed. You are emailed when it completes.

Can VibeEval scan pages behind a login?

Yes. In the Options step enable Authentication and choose Bearer Token, Cookie, Basic Auth, or Form Login, then paste the credential. The scanner attaches it to every request. Use the Secret Instruction field for anything the on-call reviewer needs but should not appear in the report.

Will a scan break my production app?

Scans are production-safe by default: they probe, they do not destroy. Tick Passive only for a read-only pass, lower Max requests per second, and add Excluded Paths such as /logout or destructive admin routes.

How many URLs does a scan test?

As many as the crawler discovers within scope, subject to Crawl Depth. The scan page shows the count of URLs tested and requests sent once the run finishes.

Running Scans: Profiles & Statuses

The four wizard steps

New Scan opens a wizard: Target → Profile → Options → Launch. You can click back to any earlier step; forward steps unlock as each is valid.

Step 1 — Target

Scan name (optional), target URL with a Validate button, scope, sitemap URL, and OpenAPI URL. See Targets for validation rules and scope.

Step 2 — Profile

Profile	Typical duration	What it does
Quick Scan	1–3 min	Passive checks, header analysis, and common vulnerabilities.
DAST Full (recommended, default)	10–30 min	Complete dynamic analysis with deep crawling, injection testing, and fuzzing.
API Scan	5–15 min	OpenAPI/Swagger-aware testing for REST and GraphQL endpoints. Give it a spec URL in step 1.
Custom	varies	Pick individual test modules and tune parameters.

Custom exposes twelve modules you can toggle: XSS Detection, SQL Injection, Command Injection, SSRF, IDOR / Broken Access, Authorization Bypass, Security Headers, TLS/SSL Analysis, CORS Misconfiguration, Weak Cryptography, Information Disclosure, and Technology Fingerprint. The full check inventory is on Security checks.

Step 3 — Options

Authentication. Enable and pick a type: Bearer Token, Cookie, Basic Auth, or Form Login. Paste the token or credential; it is attached to every request the scanner makes.

Crawl settings. Crawl depth, follow redirects, and Passive only (observe, never inject).

Excluded paths. One pattern per line, e.g. /admin/*, /api/health, /logout. Use this to keep the crawler away from destructive or noisy routes.

Networking. Max requests per second (default 50), request timeout (default 30 s), user agent (default NightProtocol/2.1), and an optional proxy URL.

Custom headers. One Header: value per line, attached to every request — useful for bypassing a WAF allowlist you control or tagging scanner traffic in your logs.

Instruction. Free-text guidance for the engine and the on-call reviewer, e.g. “Focus on authentication flows and payment endpoints.”

Secret instruction. Same idea, but for credentials or internal paths that must not appear in any exported report. Rendered in a highlighted monospace box so you notice what you typed.

Step 4 — Review and launch

A summary of everything you set, shown as badges. Launch Scan asks you to confirm the profile, target, and estimated duration, then queues the job. If your plan has no scans left you get a Scan limit reached message with an upgrade link instead — see Plans and limits.

Scan statuses

Status	Meaning
`queued`	Waiting in the queue to start.
`running`	Actively crawling and testing the target.
`pending_review`	Automated first pass finished. Awaiting on-call review, so results are not final yet.
`completed`	Scan finished and reviewed.
`failed`	Scan stopped before it could finish.
`cancelled`	Stopped by a user or the system before completion.

Alongside the main status, a deep scan status tracks the human pass: review pending, in progress, complete, or not required.

The Scans list refreshes every three seconds while anything is running or under review and shows a live N urls · M findings counter per active scan.

On-call review

Every scan on a paid plan goes through an on-call security researcher. They confirm each automated finding, remove false positives, probe areas automation cannot reach, and write a short review note. The note appears on the scan page in an On-call review card, with a separate Out of scope: not covered this pass section so you know exactly what was and was not tested.

While review is pending you see a banner: “Automated pass found N issues. A security researcher is verifying each one and probing deeper. Findings below are preliminary and may be confirmed, adjusted, or removed.”

The scan page

Risk gauge 0–100 with Low / Medium / High / Critical bands — formula on Risk score.
Trend versus the previous scan of the same target: added, fixed, and risk delta.
Copy for LLM — the whole report as Markdown, ready for a coding agent.
Re-run Scan, Report inaccuracy, and Archive.
Meta row: profile, URLs tested, requests sent, start time, and Set up monitoring.
Tabs: Findings and Report (exports — see Reports).

A scan that finds nothing shows All clear: no security issues were identified across the crawled surface.

Re-running a scan

Re-run Scan on the header creates a new scan against the same target with the same profile, named <name> (re-run). Or use Scan Now from the Targets page. Every re-run counts against your monthly scan quota and produces a fresh trend diff against the last completed run.

Archiving

Archive hides a scan from the dashboard and lists and sets its risk contribution to zero — useful for scans of decommissioned environments. Restore reverses it.

Reporting an inaccurate scan

If findings look wrong, routes were missed, or evidence is broken, use Report inaccuracy and describe the problem. Reports go straight to the detection team and are used to tune quality. Each scan can be reported once.

RUNNING SCANS