> ## Documentation Index
> Fetch the complete documentation index at: https://docs.launchsafe.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Quickstart
> Go from zero to your first AI penetration test in under 5 minutes — create an account, add a target, and launch a scan with LaunchSafe.
This guide walks you through setting up LaunchSafe and running your first security scan. By the end, you'll have a live vulnerability report for your application.
## Prerequisites
Before you begin, you'll need:
* **An application to test** — a GitHub repository, a live URL, or a ZIP archive of your source code
* **Ownership or authorization** — you must own the target or have written permission to test it
LaunchSafe performs real security testing against your application. Only scan targets you own or have explicit authorization to test. Unauthorized testing may violate computer fraud laws.
## Step 1: Create your account
Go to [app.launchsafe.com](https://app.launchsafe.com) and sign up with your email, Google, or GitHub account. Verify your email if prompted.
## Step 2: Set up your workspace
A workspace is your organization in LaunchSafe — it contains your targets, scans, findings, and team members.
1. **Name your workspace** — use your company name or project name (e.g., "Acme Corp" or "My SaaS App")
2. **Choose your team type** — select "Solo" if it's just you, or "Team" to invite collaborators
3. **Invite members** (optional) — add teammates by email. They'll get access to all scans and findings in this workspace
## Step 3: Add your target
Choose how to connect your application:
**Best for: white-box and hybrid scans**
1. Click **Connect GitHub** — you'll be redirected to GitHub to install the LaunchSafe app
2. Choose which repositories to grant access to (you can select specific repos or all repos)
3. Select the repository you want to scan
4. Choose the branch (defaults to `main` or `master`)
LaunchSafe requests read-only access to your code. Write access is only used if you enable auto-fix pull requests.
**Best for: black-box scans**
1. Enter your application URL (e.g., `https://staging.acme.com`)
2. Add a DNS TXT record to verify domain ownership:
```
launchsafe-verify=ls_your_token_here
```
3. Click **Verify** — LaunchSafe will check the DNS record
DNS verification typically completes within minutes but can take up to 48 hours depending on your DNS provider. See [DNS Verification](/core-concepts/dns-verification) for provider-specific instructions.
**Best for: offline white-box analysis**
1. Click **Upload ZIP**
2. Select your source code archive (max 500MB)
3. LaunchSafe extracts and indexes the code for analysis
Supported: any language or framework. The archive should contain your project root with package manifests (`package.json`, `requirements.txt`, `go.mod`, etc.) for accurate dependency scanning.
## Step 4: Sign the Rules of Engagement
Before any scan runs, you must sign the **Rules of Engagement (ROE)** — a legal agreement that:
* Confirms you own or are authorized to test the target
* Defines the scope of testing (limited to the targets you've provided)
* Establishes data handling terms (AES-256 encryption at rest, TLS 1.3 in transit)
* Specifies what LaunchSafe will and won't do (no social engineering, no DoS, no data exfiltration)
Read the full agreement, scroll to the bottom, check the acknowledgment box, enter your full legal name, and click **Confirm**. You'll receive a confirmation email with the signed agreement for your records.
The ROE is standard practice in penetration testing — it protects both you and LaunchSafe. It has the same legal force as a handwritten signature under the ESIGN Act and UETA.
## Step 5: Choose your plan
| | Pro | Teams | Enterprise |
| ---------------- | --------- | --------------------- | ------------- |
| **Price** | \$49/mo | From \$999/mo | Custom |
| **Scans** | 2 / month | Unlimited | Unlimited |
| **Targets** | 1 | Unlimited | Unlimited |
| **Team members** | 1 | Unlimited (\$29 each) | Unlimited |
| **Support** | Priority | Slack & PagerDuty | Dedicated CSM |
See [Plans](/billing/plans) for the full feature comparison.
After selecting **Pro**, you'll be redirected to Stripe to complete payment. Your first scan launches automatically after checkout. Teams and Enterprise plans are available by [contacting sales](mailto:sales@launchsafe.com).
## Step 6: Watch your scan in real time
You'll land on the scan detail page where you can monitor progress:
### Progress bar
Shows the current scan phase — from provisioning through reconnaissance, vulnerability analysis, and report generation. Each phase displays a label so you know exactly what's happening.
### Terminal
Live output from the scan engine. You'll see tool invocations, test results, and discovery events as they happen — similar to watching a CI/CD pipeline run.
### Sandbox metrics
Real-time CPU, memory, and network utilization of your dedicated Kali Linux scan instance. Useful for understanding scan resource usage.
### Findings
Vulnerabilities appear in real time as they're discovered, sorted by severity. Each finding is clickable for full details including evidence, location, and remediation steps.
Scans typically complete in 10–30 minutes depending on codebase size and scan type. Large applications with full hybrid scans may take up to an hour.
## Step 7: Review your results
Once the scan completes, you'll have:
1. **Findings** — each vulnerability with severity, description, evidence, and remediation
2. **Reports** — downloadable PDF, JSON, and SARIF reports for stakeholders and tooling
3. **Auto-fix PRs** — pull requests with fixes for supported vulnerability types (if GitHub is connected)
### Prioritizing findings
| Severity | CVSS Score | What to do |
| ------------ | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Critical** | 9.0–10.0 | Stop what you're doing and fix this now. These are actively exploitable and could lead to data breaches, RCE, or full system compromise. |
| **High** | 7.0–8.9 | Fix within the next few days. Significant risk that could be exploited with moderate effort. |
| **Medium** | 4.0–6.9 | Add to your current sprint. Real risk but requires specific conditions or chaining to exploit. |
| **Low** | 0.1–3.9 | Fix when convenient. Minor issues like missing best-practice headers or verbose error messages. |
| **Info** | 0.0 | Review at your discretion. Informational observations like outdated (but not vulnerable) dependencies. |
## What's next
Learn the difference between white-box, black-box, and hybrid scans to choose the right one for your needs.
Get real-time notifications in your team's Slack channel when scans complete or critical findings are discovered.
Connect a repository for code-aware scanning and automatic fix pull requests.