Credentials

The Credentials page (sidebar, Library) holds the secrets and leaked credentials of a product: those found by secrets detection, by the OSINT credential-leakage stage and the Bruteforcer of Infrastructure Checks, and those you add yourself. You can also mark credentials to be tried by the AI scanners when they audit a login form. The page shows one product at a time; choose it in the selector at the top.

zoom_inEnlarge

The list

Search credentials matches the user name and the description, never the secret value.

Adding credentials

1. Choose the product in the selector and open Add / Edit Credential.

2. Fill in the fields, or choose a file under Or upload a file.

4. Click Submit.

   Check: the list reloads with the new credential. A file that cannot be read says Invalid JSON file with the reason.

To edit a credential, click its row (not its name): the form fills with it. Change the fields and click Submit. Add Credential clears the form for a new entry.

A JSON upload is a list of objects. Each needs a user (email, username or name) and a secret (password or hashed_password); database_name becomes the description. Entries without both are skipped.

[
  {"email": "j.doe@example.com", "password": "example-password", "database_name": "example-breach-2025"},
  {"username": "admin", "hashed_password": "$2y$10$abc...", "database_name": "forum-dump"}
]

zoom_inEnlarge

Acting on several credentials

Tick credentials, then use the toolbar:

Use your own credentials in the default-credential audit

When AI DAST or the AI Pentest finds a login form, it tries a built-in list of default and common credentials. Credentials you mark here are tried as well, on top of that list. Use it for the accounts you know a product's apps ship with, or for leaked pairs you want checked. Nothing is marked by default.

1. Choose the product in the selector. Credentials of that product are used for its scans; team-wide credentials (Product: Unassigned) are used for every product.

2. Tick the credentials and click Mark for AI scans, or tick Use in AI scans when adding one.

   Check: their AI scans chip reads True.

3. Run AI DAST or an AI Pentest against the product's app.

4. Check: a pair that logs in is reported as a finding of the scan, on its page and on the Vulnerabilities page.

A credential without a user name is skipped. Marking changes only what the AI scanners try; the scan's other settings are unchanged.

zoom_inEnlarge

Verifying whether they still work

The Bruteforcer scanner of Infrastructure Checks tries the product's stored login and password pairs against the services it finds. A pair that works is logged in the scan log as Credentials confirmed!! and added to the list as a new, verified credential whose Details record where it worked.

zoom_inEnlarge

Using a credential for authenticated scans

Credentials on this page are findings; scans never log in with them on their own (the AI scans mark above only adds them to the default-credential audit). When a found login should become the account that authenticated infrastructure checks use, click the shield, Approve as the team's server account for authenticated scans, and confirm. Scans queued from then on use it. The approved account can also be entered or replaced in the Server account card on the Scanning tab of the Teams page.

zoom_inEnlarge

Who can do what

Credentials belong to the team: other teams never see them.

See Teams and roles.