Skip to main content
A black-box penetration test examines a running app from the outside through browser and network interactions. It does not use the app’s source code. In the Project Security Center, Level 3 (AI pentest) brings together three types of security checks:
  1. Free dependency and package checks
  2. Agent static analysis of your source code
  3. An external black-box test of the live Preview, conducted from outside without using your source code
After you start Level 3, Replit runs the Agent source-code review and the external black-box test in parallel.

​
Run a Level 3 scan

1

Open the project

Open the individual project you want to scan.
2

Open Security Center

In the project’s Tools pane, select Security Center.
3

Start a scan

At the top of Security Center, select Run scan.
4

Choose Level 3

Select Level 3 (AI pentest).
Security and Privacy Center open from the Tools pane with the Select scan level menu expanded and Level 3 AI pentest selected

Level 3 (AI pentest) adds Agent static analysis and an external live Preview test to free dependency and package checks.

5

Wait for both tasks

Wait for the source-code review and the browser and network black-box test to finish.
6

Review the results

Review findings from both tasks in the Security pane. Assess each finding before sending accepted issues to Agent.
7

Fix and rerun

Send accepted findings to Agent. After you apply the fixes, run another Level 3 scan to verify them.

​
Understand the two tasks

Review both sets of findings. One task does not replace the other: the source review can identify vulnerable implementation details, while the black-box test assesses the running app from the outside.

​
Next steps