> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Black-box pen tests

> Run a Level 3 security scan that reviews source code and tests the running app through browser and network interactions.

A black-box penetration test examines a running app from the outside through browser and network interactions. It does not use the app's source code.

In the Project Security Center, **Level 3 (AI pentest)** brings together three types of security checks:

1. Free dependency and package checks
2. Agent static analysis of your source code
3. An external black-box test of the live Preview, conducted from outside without using your source code

After you start Level 3, Replit runs the Agent source-code review and the external black-box test in parallel.

## Run a Level 3 scan

<Steps>
  <Step title="Open the project">
    Open the individual project you want to scan.
  </Step>

  <Step title="Open Security Center">
    In the project's **Tools** pane, select **Security Center**.
  </Step>

  <Step title="Start a scan">
    At the top of Security Center, select **Run scan**.
  </Step>

  <Step title="Choose Level 3">
    Select **Level 3 (AI pentest)**.

    <Frame caption="Level 3 (AI pentest) adds Agent static analysis and an external live Preview test to free dependency and package checks.">
      <img src="https://mintcdn.com/replit/Skn6tD6LwF4-qlqT/images/project-security-center/level-3-ai-pentest.png?fit=max&auto=format&n=Skn6tD6LwF4-qlqT&q=85&s=3483509c46c876b6701ee817fc8d5392" alt="Security and Privacy Center open from the Tools pane with the Select scan level menu expanded and Level 3 AI pentest selected" width="2204" height="1200" data-path="images/project-security-center/level-3-ai-pentest.png" />
    </Frame>
  </Step>

  <Step title="Wait for both tasks">
    Wait for the source-code review and the browser and network black-box test to finish.
  </Step>

  <Step title="Review the results">
    Review findings from both tasks in the **Security** pane. Assess each finding before sending accepted issues to Agent.
  </Step>

  <Step title="Fix and rerun">
    Send accepted findings to Agent. After you apply the fixes, run another Level 3 scan to verify them.
  </Step>
</Steps>

## Understand the two tasks

| Task               | Evidence it uses                                      | Purpose                                                                         |
| ------------------ | ----------------------------------------------------- | ------------------------------------------------------------------------------- |
| Source-code review | Your application's source code                        | Identifies security, privacy, and architectural vulnerabilities in the codebase |
| Black-box pen test | Browser and network interactions with the running app | Examines externally observable behavior without using source code               |

Review both sets of findings. One task does not replace the other: the source review can identify vulnerable implementation details, while the black-box test assesses the running app from the outside.

## Next steps

* Use [Agent security scans](/features/security/agent-security-scans) for the normal source-code workflow.
* Learn how the [Project Security Center](/features/security/project-security-center) combines scan paths and automatic checks.
* Review related terminology in [Security concepts](/features/security/concepts).