Domain Verification

Codity will not scan a domain on your word alone. Before any assessment can be started, your organization has to prove that it controls the domain. This protects you — nobody else can point Codity at your site — and it protects everyone else from having their site scanned by a stranger who happened to know the name.

Verification is a one-time step per domain. Once a domain is verified, you can run as many assessments against it as you like.

Add a domain

1. Open Pentesting in the dashboard and stay on the Domains tab.
2. Enter the domain — example.com, not https://example.com/app — and select Add domain.
3. The domain appears with the status pending and a verification challenge.

The domain must be a real, publicly resolvable name. Internal-only names, private addresses and IP literals are rejected.

Prove ownership

Expand the pending domain to see its challenge. Codity generates a unique, random verification token for your domain and offers three ways to publish it. You only need one to succeed.

CNAME record

Type:  CNAME
Name:  _codity-verify.example.com
Value: <your-token>.validation.codity.ai

TXT record

Type:  TXT
Name:  _codity-verify.example.com
Value: codity-verification=<your-token>

Verification file

Publish the token as the contents of a file served over HTTPS:

URL:     https://example.com/.well-known/codity-verification.txt
Content: <your-token>

The file check requires HTTPS and does not follow redirects, so the file must be served directly at that exact URL.

Each challenge is shown with a copy button so you can paste the exact value into your DNS provider or web server.

Verify

Pick the method you published, then select Verify. Codity checks for the token immediately and marks the domain verified on success.

If it does not find the token, the domain stays pending and the reason is shown on the row. The usual cause is DNS propagation — a newly published record can take anywhere from a minute to a few hours to become visible, depending on your provider and the record's TTL. Wait, then verify again. Nothing is lost by retrying, and the token stays the same.

info

Keep the record or file in place. It costs nothing to leave published, and it is what lets you re-verify without generating a new token later.

What a verified domain covers

Verifying example.com authorizes example.com itself and any host beneath it at a label boundary — app.example.com, api.staging.example.com, and so on.

It does not authorize names that merely look similar:

If you want to test a domain that is not beneath a domain you have already verified, add and verify it separately.

Ownership belongs to your organization

Domains, targets, runs and reports are scoped to the organization that created them. Another Codity customer cannot see your domains, start a scan against them, or read your reports — and verifying a domain in your organization gives no one outside it any additional access.

Removing a domain

Deleting a domain also deletes the active test targets configured beneath it. Existing reports are kept until you delete them individually from the Reports tab.

Next

• Run an observation-only assessment: Black-Box Scans
• Configure an active test: Active Test Targets