Quickstart

This walks you from an empty workspace to your first proven findings. It takes about five minutes plus scan time.

1. Add an asset

In the dashboard, open the asset kind you want (Repositories, Applications & APIs, Containers, Clouds or Virtual machines) and connect one. Every asset carries a per-kind identity (for a repository, the owner/name; for a domain, the hostname).

2. Prove you own it

Kissaki only scans what you have proven you own. Ownership verification differs by kind:

• Domain and public-host VM: publish the DNS TXT record Kissaki shows you.
• Repository: authorise through the git provider.
• Container and Cloud: connect the credential.

Once the proof is observed, the asset flips to verified - the state the scan selection reads before it will scan anything.

3. Scan

A scan is a bounded connector pass against one asset; an agentic campaign is a full pentest run. Start either from the asset. Kissaki records the rules of engagement (scope, excluded paths, non-destructive by default) against your workspace consent before anything runs.

4. Read the findings

Findings arrive normalised, deduplicated and severity-ranked. Open one to see its proof: proven (a reproducible exploit), evidence, or a reproducer. Deterministic detections (SCA, secrets, misconfig, licences) are delivered as-is - the detection is the proof.

5. Keep it flowing

• Turn on PR gating to block risky pull requests.
• Add the scanner's WAF allow-rule so scans are not throttled.
• Pull the same data over the API.