Skip to main content
This guide walks you through setting up LaunchSafe and running your first security scan. By the end, you’ll have a live vulnerability report for your application.

​
Prerequisites

Before you begin, you’ll need:
  • An application to test — a GitHub repository, a live URL, or a ZIP archive of your source code
  • Ownership or authorization — you must own the target or have written permission to test it
LaunchSafe performs real security testing against your application. Only scan targets you own or have explicit authorization to test. Unauthorized testing may violate computer fraud laws.

​
Step 1: Create your account

Go to app.launchsafe.com and sign up with your email, Google, or GitHub account. Verify your email if prompted.

​
Step 2: Set up your workspace

A workspace is your organization in LaunchSafe — it contains your targets, scans, findings, and team members.
  1. Name your workspace — use your company name or project name (e.g., “Acme Corp” or “My SaaS App”)
  2. Choose your team type — select “Solo” if it’s just you, or “Team” to invite collaborators
  3. Invite members (optional) — add teammates by email. They’ll get access to all scans and findings in this workspace

​
Step 3: Add your target

Choose how to connect your application:
Best for: white-box and hybrid scans
  1. Click Connect GitHub — you’ll be redirected to GitHub to install the LaunchSafe app
  2. Choose which repositories to grant access to (you can select specific repos or all repos)
  3. Select the repository you want to scan
  4. Choose the branch (defaults to main or master)
LaunchSafe requests read-only access to your code. Write access is only used if you enable auto-fix pull requests.

​
Step 4: Sign the Rules of Engagement

Before any scan runs, you must sign the Rules of Engagement (ROE) — a legal agreement that:
  • Confirms you own or are authorized to test the target
  • Defines the scope of testing (limited to the targets you’ve provided)
  • Establishes data handling terms (AES-256 encryption at rest, TLS 1.3 in transit)
  • Specifies what LaunchSafe will and won’t do (no social engineering, no DoS, no data exfiltration)
Read the full agreement, scroll to the bottom, check the acknowledgment box, enter your full legal name, and click Confirm. You’ll receive a confirmation email with the signed agreement for your records.
The ROE is standard practice in penetration testing — it protects both you and LaunchSafe. It has the same legal force as a handwritten signature under the ESIGN Act and UETA.

​
Step 5: Choose your plan

See Plans for the full feature comparison. After selecting Pro, you’ll be redirected to Stripe to complete payment. Your first scan launches automatically after checkout. Teams and Enterprise plans are available by contacting sales.

​
Step 6: Watch your scan in real time

You’ll land on the scan detail page where you can monitor progress:

​
Progress bar

Shows the current scan phase — from provisioning through reconnaissance, vulnerability analysis, and report generation. Each phase displays a label so you know exactly what’s happening.

​
Terminal

Live output from the scan engine. You’ll see tool invocations, test results, and discovery events as they happen — similar to watching a CI/CD pipeline run.

​
Sandbox metrics

Real-time CPU, memory, and network utilization of your dedicated Kali Linux scan instance. Useful for understanding scan resource usage.

​
Findings

Vulnerabilities appear in real time as they’re discovered, sorted by severity. Each finding is clickable for full details including evidence, location, and remediation steps.
Scans typically complete in 10–30 minutes depending on codebase size and scan type. Large applications with full hybrid scans may take up to an hour.

​
Step 7: Review your results

Once the scan completes, you’ll have:
  1. Findings — each vulnerability with severity, description, evidence, and remediation
  2. Reports — downloadable PDF, JSON, and SARIF reports for stakeholders and tooling
  3. Auto-fix PRs — pull requests with fixes for supported vulnerability types (if GitHub is connected)

​
Prioritizing findings

​
What’s next

Understand scan types

Learn the difference between white-box, black-box, and hybrid scans to choose the right one for your needs.

Connect Slack

Get real-time notifications in your team’s Slack channel when scans complete or critical findings are discovered.

Connect GitHub

Connect a repository for code-aware scanning and automatic fix pull requests.