# AI Pentesting Scope

Scope defines **what** Escape is allowed to explore and test during an AI Pentesting assessment, and **what it must stay away from**.

Scope is separate from **context** (the free-text field in Fine-Tune). Context steers focus ("prioritize checkout"). Scope is structural: target URLs, exploration mode, and hard exclusions.

Configure scope in the **Scope** section of the New Profile form. It's the first step when you create or edit a profile.

---

## Scope Modes

| Mode | When to use | Behavior |
| --- | --- | --- |
| **Standard** (recommended) | Most engagements | Escape starts from your listed URLs and can include related assets in the same application footprint (for example APIs your frontend calls). |
| **Strict** | Regulated or contained environments | Escape tests the listed hosts and URL path prefixes, with read-only CDN and static-asset allowances. |

Strict mode matches each target's host and path with a prefix rule for both HTTP and HTTPS. A target of `https://app.example.com/api/` allows paths under `/api/`.

In **Strict** mode, list every layer you care about: frontend, API, admin, and any other host the assessment should touch. In **Standard**, start with the main web app; Escape can explore related APIs in the same application footprint.

---

## Scope Restrictions

Restrictions are an optional **blocklist**: paths or GraphQL operations that must never be reached. They apply in **both** Standard and Strict mode.

Add restrictions in the **Scope restrictions** section of the form.

> [!NOTE]
>
> **Default restrictions**
>
> New pentest profiles are pre-populated with a few safe defaults so agents don't disrupt sessions or destroy accounts: `*logout*` (all methods), `*password*` and `*2fa*` on `PUT`/`DELETE`/`PATCH`, and `*user*` on `DELETE`. You can edit or remove these in the form.

| Type | What it blocks | Example |
| --- | --- | --- |
| **URL** | HTTP traffic to a matching URL or path | `https://*.example.com/admin/*`, `*/internal/*` |
| **GraphQL** | Any GraphQL request matching GraphQL operation | `mutation.deleteAccount`, `mutation.delete*` |

### URL Restrictions

- Use wildcards: `*` matches any characters.
- Optionally limit to one HTTP method (`GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`, `HEAD`). Leave method as **ANY** to block all methods on that path.

Examples:

- `https://example.com/admin/*`
- `POST` on `https://example.com/api/billing/charge`

### GraphQL Restrictions

Target operations by canonical name: `<type>.<field>` (for example `mutation.deleteAccount`). Wildcards are supported (`mutation.delete*`).

---

## How Restrictions Are Enforced

Escape enforces scope at multiple layers during an assessment:

1. **Network boundary**: traffic from the assessment's browser and code-execution companions passes through a scope-aware proxy. Out-of-scope requests are blocked before they reach the target.
2. **In-process checks**: agents and security checks consult the same scope rules when deciding where to navigate and what to attack.
3. **Agent prompts**: scope is included in the authoritative context given to the AI Pentesting agents.

URL restrictions block matching endpoints. GraphQL restrictions parse request bodies to match operation names (for example `query.users`, `mutation.deleteUser`) and block matching operations.

> [!NOTE]
>
> **Strict mode and static assets**
>
> In **Strict** mode, Escape also allows **read-only** loads (GET, OPTIONS, HEAD) from common CDNs and static file types so pages can still render. This is automatic; you don't configure it in the form.
>
> **CDN hostnames allowed** (any URL whose host contains):
>
> - `gstatic.com`
> - `cloudflare.com`
> - `akamai.com`
> - `maxcdn.com`
> - `cdnjs.com`
> - `ajax.googleapis.com`
> - `cloudfront.net`
>
> **File extensions allowed** (URL path ends with):
>
> - `.css`, `.js`, `.png`, `.jpg`, `.jpeg`, `.gif`, `.svg`

---

## Scope vs Other Guardrails

Scope controls **where** testing happens. Other guardrails control **how hard** or **how long** an assessment runs:

- [Rate limit and max duration](<https://docs.escape.tech/documentation/ai-pentesting/guardrails/#rate-limit>)
- [Kill switches](<https://docs.escape.tech/documentation/ai-pentesting/guardrails/#kill-switches>)

---

## Related Documentation

- [Quickstart: Configure Scope](<https://docs.escape.tech/documentation/ai-pentesting/quickstart/#step-2-configure-scope>)
- [Guardrails](<https://docs.escape.tech/documentation/ai-pentesting/guardrails/index.md>): Kill switch, rate limit, and max duration
- [How It Works](<https://docs.escape.tech/documentation/ai-pentesting/how-it-works/index.md>): Full assessment workflow