Documentation overview

How BreakMesh works

This documentation explains how BreakMesh works end to end: how targets are authorized, how assessments are kept within scope, how standard scanning differs from Active Pentest, how cloud, AI and mobile workflows are authorized, how findings and reports work, and how customers use the platform responsibly.

It's written for developers, security teams, CTOs, agencies, customer security reviewers, procurement teams and compliance reviewers evaluating BreakMesh — not just what BreakMesh scans, but how authorization works, what safeguards exist, how active testing is controlled, what evidence is produced, and where the product's boundaries are.

Quick Start

1. Add a target 2. Verify or authorize it 3. Choose coverage 4. Review evidence-backed findings

Add a website, application, cloud account, AI endpoint or mobile app you're authorized to assess. Complete the authorization workflow appropriate to that assessment type (see Authorization Model below), then run one or more of the 10 standard packages. Add Active Pentest separately once you're ready for consent-gated active validation.

Authorization Model

Different assessment workflows use different authorization mechanisms. BreakMesh does not use DNS verification for every assessment — the authorization method matches what's actually being tested.

Authorization	Used for
Verified domain	Domain-based website and application testing
Explicit consent	Selected interactive and AI workflows
Read-only cloud credentials	AWS / Azure / GCP Cloud Posture
Uploaded artifact	APK / IPA Mobile Static Analysis
Signed SOW + Rules of Engagement	Automated Active Pentest

Consistent across the product

This authorization mapping is the same on Docs, FAQ, Pricing, Scanners and the Active Pentest page — one source of truth, not five separate descriptions.

Scanner Safety & Authorization

How BreakMesh keeps standard assessments scoped, controlled and authorized — and how the safety model changes for cloud, AI, mobile and automated Active Pentest workflows.

Standard BreakMesh packages are designed to minimize production impact through non-destructive observations, controlled requests, scope restrictions, concurrency controls and cooldowns.

Scope controls

Verified target boundaries — requests stay inside the authorized target
Off-scope redirect restrictions — scans do not follow redirects out of scope
Private-network blocking
Localhost blocking
Link-local blocking
Metadata-endpoint blocking (cloud instance-metadata services)
Controlled concurrency
Scan cooldowns
Bounded request behavior

Standard scanning vs. Active Pentest

All standard package checks are designed to be non-destructive. Active Pentest is a separate testing mode that uses consent-gated automated active probes within an approved, time-bounded engagement. Active Pentest probes are not standard checks — see Active Pentest Safety.

If testing needs to stop

What should I do if testing needs to stop?

Use Emergency Pause for Active Pentest.
Pause or disable scheduled standard assessments.
Contact BreakMesh support if unexpected target behavior continues.

Read the full Scanner Safety & Authorization page →

Responsible Use

BreakMesh is intended only for systems you own, operate, or are explicitly authorized to assess. You remain responsible for complying with customer agreements, platform policies, and applicable law.

Do not attempt to bypass scope restrictions, authorization controls, or network safeguards.

Read the full Responsible Use page →

Active Pentest Authorization & Safety

Fully automated

BreakMesh Active Pentest is fully automated. No human pentester manually executes the supported Basic or Advanced probe set.

Workflow

Approve target Sign SOW + RoE Define targets, URLs & window Lock engagement scope Run Basic/Advanced probes Capture evidence

Emergency pause is available at any point in the workflow.

Pentest Basic — 11 automated active probes

Covering selected vulnerability classes including:

SQL Injection (Error-Based)
SQL Injection (Boolean-Blind)
XSS — Reflected
XSS — Stored
XXE Injection
Path Traversal
Open Redirect (Active)
Auth Bypass Probes
IDOR (Two-Account)
Broken Function Auth (Active)
HTTP Parameter Pollution (HPP)

Pentest Advanced — 9 additional automated active probes

Extending Basic with:

Command Injection (Timing)
SSRF (Callback)
Header Injection
File Upload Bypass
API Mass Assignment
Insecure Deserialization (Timing)
Business Logic — Price Manipulation
HTTP Request Smuggling / Desync Readiness
Web Cache Poisoning Readiness

Safety controls

Signed SOW + Rules of Engagement

Required before any probe runs.

Explicit customer consent

The engagement only proceeds once authorized.

Approved testing window

Probes run only within the agreed time-bounded window.

Hard URL scope enforcement

Probes cannot run against out-of-scope URLs.

Per-scan request budget

Each engagement has a bounded request budget.

Target-specific engagement

Each engagement is scoped to specific, named targets.

Emergency pause

The engagement can be paused immediately at any time.

Destructive payload restrictions

Data-destroying payloads are excluded from every probe class.

Traceable assessment record

Every probe and finding is recorded against the signed engagement.

Product boundary

BreakMesh provides automated active validation for the supported probe classes. Some customer contracts, assurance programs or complex applications may still require broader human-led exploratory testing.

Standard Assessments

101 security & assurance checks across 10 standard packages.

Package	Checks
Basic Hygiene	15
OWASP Starter	14
Threat Readiness	8
Auth & Session	15
API Security	16
Compliance Evidence	10
Cloud Posture	10
AI Security	10
Mobile Static Analysis	1
Web Quality Evidence	2

See the full scanner catalogue →

Cloud Posture

Authorized read-only AWS, Azure and GCP configuration checks. Selected areas covered include:

Public storage exposure
Open ingress rules
IAM risks
Logging gaps
Encryption configuration

Credential scope

Use credentials with the minimum read-only permissions necessary for the supported checks. Do not provide write or administrative access. Credentials are used only for the duration of the scan and are never stored.

AI Security

Consent-gated, controlled text-only canary probes for approved LLM and AI chat interfaces.

Explicit consent required before testing
Controlled text-only canary probes — not exploit payloads
Approved LLM / chat interface only, never a general endpoint
Tool-calling should be disabled during the assessment
Real-world agentic actions should be disabled during the assessment

Mobile Static Analysis

Upload an Android APK or iOS IPA for offline static analysis of selected application-security indicators.

Embedded secrets
Transport security
Insecure storage
Exported components
Sensitive permissions

The uploaded artifact is analyzed without interacting with the live mobile application service.

Reports & Evidence

Findings include severity, confidence, supporting evidence and remediation guidance.

JSON reports
PDF reports
White-label PDF where supported
Evidence mapping to SOC 2 Trust Services Categories and selected compliance frameworks

What evidence mapping is not

BreakMesh provides selected evidence and evidence mapping. Compliance/evidence mapping does not certify compliance.

API & Webhooks

Agency and Enterprise plans include API key access and signed outbound webhooks for scan and subscription events. The interactive endpoint reference is kept separate from this documentation portal.

Open the API Reference →

Usage & Package Runs

One package run means one selected standard scanner package executed against one target.

Example

10 standard packages × 10 targets = 100 package runs

Active Pentest is an authorized engagement and is not treated as a normal standard package run.

Glossary

Package run	One standard scanner package executed against one target.
Active probe	One consent-gated, automated exploitation attempt run as part of an Active Pentest engagement — not a standard check.
Engagement	A signed, time-bounded, scope-locked Active Pentest authorization (SOW + Rules of Engagement).
Verified domain	A target confirmed via DNS TXT record before domain-based testing begins.
Evidence mapping	Selected findings organized against SOC 2 / compliance framework categories — not a certification.
CVSS	Common Vulnerability Scoring System — a severity score attached to confirmed Active Pentest findings.
OAST	Out-of-band Application Security Testing — callback-based confirmation used by selected Active Pentest probes (e.g. SSRF).