> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/pentests/prepare-a-pentest/preparing-for-a-pentest.md).

# Preparing for a Pentest

Before starting a pentest, you need to prepare your environment. These one-time steps ensure Aikido’s agents can safely access your app and perform a meaningful assessment without getting blocked.

Follow this checklist to get set up quickly.

{% stepper %}
{% step %}
**Prepare a Test Environment**

Run the pentest in a non-production environment (e.g. Staging) to avoid impacting live users.

* **Mirror Production:** Ensure the setup matches your live architecture.
* **Safe Data:** Use dummy data only. No real customer PII.
* **Fully Functional:** Enable all features and integrations.
  {% endstep %}

{% step %}
**Allowlist Aikido IPs**

Your security tools will likely block our testing agents. To prevent this, allowlist the [Aikido IPs](/pentests/prepare-a-pentest/ip-addresses-for-pentest.md) in:

* **Network Firewall:** Allow inbound traffic.
* **WAF:** Disable blocking and rate-limiting rules.
* **Bot Defense:** Disable behavioral blocking and rate limits.
  {% endstep %}

{% step %}
**Prepare Test Accounts**

Create dedicated test users in your staging environment so our agents can test authenticated paths.

* **Roles:** Create at least one **Admin** and one **Standard User** to test for privilege escalation.
* **Multi-Tenancy:** If applicable, create users in different tenants (e.g., Tenant A vs. Tenant B) to check for data leakage.

**See guide:** [Setting Up Test Users](/pentests/configure-a-pentest/setting-up-authenticated-testing.md)
{% endstep %}

{% step %}
**Connect Your Code**

White box testing uncovers significantly deeper vulnerabilities. By connecting your source code repositories to Aikido, our agents gain full visibility into your application logic, enabling more accurate and impactful findings.

**Recommended:** Connect all repositories related to the application to Aikido.

**See guide:** [Connect Your Repositories](/getting-started/setting-up-your-account/create-account-and-connect-your-repositories.md)

**Can’t connect your repositories?**\
If direct repository access isn’t possible you can still improve coverage by providing supporting materials such as API specifications or other internal documentation.

**See guide:** [Leveraging Code and Documentation](/pentests/configure-a-pentest/leveraging-code-and-documentation.md)
{% endstep %}

{% step %}
**Verify Ownership**

To prevent abuse, we strictly require proof of ownership before launching attacks.

* **How to verify:** Currently, this step is integrated into the pentest wizard. Start a new pentest and click through to the final step to find the DNS or File verification options.
  {% endstep %}
  {% endstepper %}

**Not sure?** If you have complex auth flows or architectural constraints, hit the Intercom chat in the bottom right. We can help to prepare in real-time.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/pentests/prepare-a-pentest/preparing-for-a-pentest.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.