Applications and targets
A pentest application is your declaration that you may authorize active testing. Under it you define targets: the host and endpoints to test. Optionally attach API documentation, credentials, and source code: connected source repositories, or a zip of your codebase when it is not in a connected repository.Uploading source code as a zip
Upload a.zip of your codebase on the application. It must be at most 300 MB, unpack to at most 3 GB and hold at most 200,000 files, so leave out dependency and build folders. Amnify checks every file in the archive before accepting it and refuses one that is encrypted, contains a link pointing outside the archive, or contains paths that would land outside it. Use standard zip compression: archives in the large-file zip format, or compressed with other methods such as LZMA or bzip2, are refused. File Explorer’s Compress to ZIP file, macOS Compress, and git archive --format=zip all produce a zip that works. The upload belongs to your organization and is only read by that application’s white box runs. Upload another zip to replace it, or remove it, from the application’s settings; deleting the application deletes the upload.
Findings traced to uploaded code name the file and lines within the archive. An upload is not a repository, so Amnify cannot open a pull request for it and the fix phase runs only for connected repositories.
Domain verification is mandatory
A target cannot run until you prove you control the domain. Amnify gives your organization a unique value. Publish it as a DNS TXT record on the name it shows, or as plain text at the well known URL it shows, then check.Choosing the run
Two independent choices.Quick
The highest impact, most commonly exploited ways in: broken authentication and access control, injection, remote code execution, server side request forgery, exposed secrets. Light traffic, low cost. It will not chain small issues into one attack path.
Deep
Audit ready. Everything in Quick plus the full exposed surface, per role access control, business logic and race conditions, file upload abuse, prompt injection, and chained attack paths. Every severity, at higher traffic and cost. A Deep run also comes with a PDF report you can download once it finishes.
How a run works
A run moves through three phases: surface mapping, discovery and validation. Only validated results become findings: a working, minimal, non destructive proof of concept, or for a known vulnerable dependency, its version independently confirmed as present. Every finding carries a proposed fix, and in a white box run it traces to the file in your source.Scheduling
Daily, weekly or monthly, per combination of engagement and package. A target can hold up to six schedules, one per combination, each pausable.Penetration tests and scans never overlap on the same scope. Different scopes can run at the same time.