Pentesting FAQ
How is this different from the security scanning on my pull requests?
They answer different questions. Pull-request scanning reads your source code and tells you what is wrong in the change you are about to merge. Pentesting never sees your code — it tests the running system from the outside, the way an attacker reaches it, and tells you what is actually exposed and exploitable. Most teams run both. See Security Scanning.
Do I need to give Codity access to my source code?
No. Every level works from the outside only, against a domain you have verified, with no repository access of any kind.
Which assessment should I start with?
Run a black-box scan first to see your public footprint — it sends your application no traffic at all, so it needs no coordination. Then run an active test in Standard mode against your main application. See Scan Modes.
Can I run this against production?
A black-box scan, yes — always, with no coordination, because it sends your application no traffic at all.
Active tests send real traffic, and from Standard mode upwards may modify data. Run the first one against staging, tell your on-call before the first production run, and read Scope and Safety.
How long does a scan take?
A black-box scan takes minutes. An active test is capped by its scan mode: Quick 15 minutes, Standard 1 hour, Deep 4 hours. Those are ceilings — a small application finishes sooner.
Why did my scan find nothing?
Usually one of four reasons:
- The scan mode you ran does not look for the class of issue you expected — Quick does not send attack payloads, so it will not find injection or XSS.
- The application is behind a login and no credentials were supplied, so only the anonymous surface was assessed.
- A supplied session cookie or token had expired.
- A WAF or rate limiter blocked the scan.
A run that could not reach the target at all does not come back empty — it comes back failed, with the reason on the row.
A genuinely clean Standard report is also a real result — and it is the one you want to show a customer.
Why do I get fewer findings than other scanners give me?
Because unproven candidates are discarded. A finding the scanner observed — a missing header, a cookie flag — is proven by the response itself and reported. A finding the scanner attacked is a judgement about exploitability, so it is checked against the exact request sent and the exact response returned, and anything the evidence does not support never reaches your report. The goal is a report your team acts on rather than one it argues with.
Can I test an API rather than a web application?
Yes. Point the target URL at the API root and supply a bearer token. Codity discovers and attacks API parameters the same way it does form fields.
Can I test a single-page JavaScript application?
Yes, and use Deep mode for it. Deep drives a real browser to discover routes and endpoints that a conventional crawler never sees. Standard covers a SPA, but less completely.
Can I scan a subdomain?
Yes. Verifying example.com covers every host beneath it, so
app.example.com and api.staging.example.com can be configured without any
further verification.
Can I scan an internal or staging system that is not on the public internet?
No. Codity tests from the public internet and refuses to send traffic to private or non-routable addresses. A staging environment that is publicly reachable — on a verified subdomain, protected by credentials you supply — works well.
How many scans can I run at once?
One per organization at a time. Starting a second while one is queued or running is refused, before any payment is taken.
What does it cost?
Pentests are bought per run, and each level is priced separately. The price is shown before you confirm, and nothing is charged for a run that would have been refused. Some plans include complimentary runs; if yours does, the run starts without a payment step.
Who can see my reports?
Only your organization. Domains, targets, runs and findings are scoped to the organization that created them.
Can I hand the report to a customer or auditor?
Yes — that is what it is for. The PDF is written for an external reader, carries your organization's name and a confidentiality footer, and redacts the credentials used during the assessment. See Reports and Findings.
Does a report satisfy SOC 2, ISO 27001 or a customer security questionnaire?
It provides the evidence those processes ask for: a scoped, dated assessment of a named system, with findings, severities, CVSS scores, CWE references, and a record of what was remediated since the previous assessment. Whether your specific auditor accepts automated testing alone is their determination — most frameworks also expect periodic human-led testing for high-risk systems.
How often should I run one?
A common pattern: an active test in Standard mode monthly or quarterly against each production application, Deep annually or before an audit, and a black-box scan on every domain you own whenever your external footprint changes.
