Skip to main content
A browser in a Docker sandbox runs the attack of each finding and records the requests, screenshots, and a video as proof. Live validation is off by default.
Live validation sends real attack requests, and a test can change or delete data. Test only applications that you own or are authorized to test. Use a test or staging environment, not production.

​
Prerequisites

  • Docker, installed and running.
  • A running copy of your application that your machine can reach.
The first run builds the sandbox image. This takes a few minutes.

​
Run live validation

Add --live-validate and the URL of your application to a scan:
The sandbox can reach applications on your own machine, so a localhost URL works. To test the findings of a finished scan, run agentgg live-validate on its output directory:
Then run agentgg score ./out and agentgg fix ./out to update the scores and the suggested fixes for the new results.

​
Add testing instructions

Use --target-context to tell the test how to use your application, for example the account to sign in with, the pages to test, and the actions to avoid. Pass the text directly, or @ followed by the path to a file.
testing-instructions.txt
The output directory stores these instructions, and the captured requests contain the session of the test account. Use a dedicated test account, and do not share the output directory publicly.

​
Results

Live validation tests each primary finding, except findings that the validator marked out-of-scope. A finding is reproduced only when the attack succeeds and the same steps with harmless input do not.

​
Evidence

Each tested finding gets a ### Live validation section in its finding file, with the result and the reasoning. reproduced and refuted findings also keep their evidence in a folder next to the finding file: the test script, the Playwright trace, screenshots, and the requests. A reproduced finding also keeps a video of the attack. Run agentgg view ./out to see the evidence in your browser.

​
Options

For all flags, see Scan flags.