Plant a flag. Test what stays private.

A flag is a unique synthetic secret in your app’s private data. If the assessment agent retrieves it, you have evidence of an exposure.

1. Choose a private location

Use a normal record your app already protects: an unpublished draft, a private document, a staff note, or an account setting. It should be readable by its legitimate owner through the application.

Use synthetic test data. A flag is never a real password, customer record, or API credential.

2. Ask your coding agent to plant it

Generate a random, unique secret of 12–256 characters.
Store it in an existing private record in my app.
Confirm the record's owner can retrieve the exact value.
Confirm a logged-out request does not reveal it.
Keep it out of public pages, browser bundles, and version control.
Tell me where you placed it and keep the value in my secret store.

3. Connect the right hosts

Register your website and publish its ownership proof. If your frontend uses a separate backend, such as a Supabase project, include its hostname in Backend hosts. Declare only hosts you are authorized to test.

4. Start the assessment

Open New assessment in your workspace. Select the verified website, enter the exact flag, and choose your time and request limits. Add a webhook if you want signed results delivered to your application.

The flag is encrypted and withheld from the assessment model. The service checks successful responses and submitted candidates for an exact match.

5. Review and clean up

A capture proves the synthetic secret was accessible. Read the request evidence, fix the access-control issue, and run another assessment to check the change. Remove or rotate your flag afterward.

No capture does not certify the website secure. It means this run did not retrieve that flag within its budget.