Emerald Red Team
Scan my app — free

Docs

Documentation

Everything you need to scan, verify and fix.

Getting started

Create a project, add your app's URL and run your first scan.

  1. Sign up and confirm your email.
  2. Create a project and choose the AI tool you build with, so fixes are written for it.
  3. Add your app's URL as a target and run a Quick Check.

Verify ownership

Unlock authenticated, backend and active tests.

  1. DNS: add a TXT record _redteam-verify.<host> with the token shown in the app.
  2. File: serve the token as text/plain at https://<host>/.well-known/redteam-verification.txt.
  3. Meta tag: add <meta name="redteam-verification" content="<token>"> to your home page.
  4. Shared hosts (*.vercel.app, *.lovable.app…) verify each exact host only.

Test identities

Let us log in as two users to find broken access control.

  1. Create two throwaway accounts in your app (User A and User B). Never use real users.
  2. Add them in Project → Test identities. Credentials are encrypted and used only during scans.

MCP, API & GitHub Action

Pull findings into your agent or CI (Pro).

  1. Create an API key in Settings → API keys.
  2. MCP endpoint: /api/mcp on the app domain. REST: /api/v1.
  3. GitHub Action: run a scan on every deploy and fail on new critical findings.

Ready? Create a free account or run a free check.