The simplest way to run TigerStrike is the hosted SaaS path — TigerGate runs the worker, you point it at a public target. When this works:
  • Target is reachable from the public internet (no VPN, no IP allow-list against TigerGate’s egress IPs).
  • You’re OK with the scan traffic coming from TigerGate’s IP block (we publish them on request for allow-listing).
When it doesn’t work — and you should use the self-hosted worker instead:
  • Target is on a private subnet, behind a VPN, or under an allow-list TigerGate isn’t on.
  • You need to scan a private codebase that you can’t push to a public Git host.
  • You have a corporate policy forbidding cloud SaaS from probing your infrastructure.

​
Run your first hosted scan

1

Configure an LLM provider

Dashboard → Pentest → Settings → AI Providers → Add provider.Pick OpenAI, Anthropic, Google Gemini, Azure OpenAI, or any OpenAI-compatible endpoint. Paste your key, click Test — the dashboard makes a tiny live call to confirm.Provider keys are stored encrypted at rest in TigerGate. They’re injected into each scan job at runtime. See LLM providers for the full list.
You can run TigerStrike without configuring a key, but in that mode the scan only runs the deterministic-checks portion (no agentic exploitation). For real pentest results, configure a provider.
2

Set a budget (recommended)

Dashboard → Pentest → Settings → Budgets.
  • Per-scan budget (USD) — hard cap for one scan. Default: $25.
  • Monthly org budget (USD) — hard cap across all scans this month. Default: unlimited.
When a budget cap is reached, in-flight LLM calls finish, the scan is marked budget_exhausted, and the dashboard shows the cost so far. See Budgets & spend.
3

Create a target

Dashboard → Pentest → New Scan.
FieldNotes
Target typeWeb app / API / Codebase
Target URLhttps://staging.example.com (must be publicly reachable)
Scopeauth, api, auth+api, or full
Max durationWall-clock cap, in minutes (default 60)
Per-scan budgetDefaults to your org-level setting; you can lower it for this run
RunnerTigerGate hosted
4

Start scan

Click Start scan. The scan moves through queued → running → completed (or budget_exhausted / cancelled / failed).
5

Watch findings come in

Pentest → Scans → <your scan> streams findings as they’re confirmed by the agents. You don’t have to wait for the scan to end — each finding has its own reproducible payload and exploit narrative.

​
Authenticating against the target

Most real-world targets need auth. TigerStrike supports:
AuthHow to configure
None (anonymous)Default
Basic authUsername + password fields in the scan config
Bearer tokenStatic token; pasted into the scan config
Form loginProvide login URL + username + password fields. The agent navigates the form on each session.
OAuth (PKCE)Provide client ID, scopes, the agent walks the flow
Custom session cookiePaste cookie value(s); useful for quick sandbox logins
For form login + OAuth, TigerStrike runs the auth flow at the start of each agent session and re-authenticates if cookies expire mid-scan.
Use a non-production credential. TigerStrike will exercise privilege boundaries — it will try to access other users’ data, escalate to admin, exfiltrate information. Use a dedicated low-privilege test account; never your real admin login.

​
Scope

Picking the right scope matters for both quality and cost:
  • auth — only the auth surface. Login form, password reset, MFA, session management. Cheapest scan.
  • api — only API endpoints (REST/GraphQL/SOAP). Skips the login flow; assumes you’ve provided a token.
  • auth+api — login first, then probe everything you can reach as the authenticated user. Good general-purpose scope.
  • full — everything above plus deep crawl. Most thorough; most expensive.
The dashboard shows estimated minutes + cost per scope before you click Start.

​
Reusable scan configs

After you run a few one-off scans, save the common settings under Pentest → Scan Configs and reuse:
  • One-off — pick Pentest → New Scan and select a saved config.
  • Scheduled — schedule a config to run nightly / weekly under Pentest → Schedules.
  • CI-triggered — POST /v1/pentest/scans with the config ID. See the API reference.