Safety & Guardrails
Exclusions
Exclude specific paths, hosts, or actions from penetration testing.
Exclusions let you define what the agent should avoid during a test, giving you fine-grained control over the testing scope.
Path exclusions
Exclude specific URL paths or patterns:
/admin/*
/api/v1/payments/*
/api/v1/users/*/deleteThe agent will not send any requests to excluded paths.
Host exclusions
Exclude entire hosts or subdomains:
payments.example.com
internal.example.comMethod exclusions
Restrict specific HTTP methods:
- Block
DELETErequests to prevent data removal - Block
PUT/PATCHto prevent data modification - Allow only
GETandPOSTfor read-heavy testing
Configuring exclusions
- When creating a new test, expand the Scope section
- Add exclusion rules under Exclusions
- Use glob patterns for flexible path matching
Exclusions are enforced at the agent level — the agent validates every request against your exclusion rules before executing.

