Skip to main content
Red Team Scans are in early access, free during early access, and available on request. Contact Aptible Support to request access for your organization.

​
What is a Red Team Scan?

A Red Team Scan finds exploitable security problems in the applications an organization runs on Aptible. It reads the code and dependencies in the Docker images deployed to your Apps, combined with what Aptible knows about how they are deployed and connected. That added context lets the scan look for problems a traditional code-only scan or pen-test misses:
  • A flaw in an internet-facing app that an outside attacker can reach directly.
  • A path from a public app into a private service, such as an internal API or database that is not exposed on its own.
  • Chains of the two, where a weakness in one app leads to a weakness in another.

​
What a scan DOES NOT do

A scan reads code and deployment facts. It does not touch a running system:
  • It does not build or run the organization’s code, in any environment.
  • It does not send traffic to running apps or query live endpoints.
A scan also does not examine live secrets. It redacts any secret-shaped files and references in your code, and examines only one-way-hashed secrets in environment variables.

​
How a scan works

The scan runs in an isolated sandbox on Aptible’s infrastructure. The sandbox contains no credentials. Findings are kept confidential to Aptible’s security team and the organization. Sandboxes are built to meet or exceed best practices for sandbox agent containment.
During early access:
  • Aptible chooses which of the organization’s apps are in scope.
  • The sandbox’s only outbound network access is to the AI model the scan uses.
  • People on Aptible’s security team review every report before it is delivered. A scan takes several business days.

​
Request, cancel and download scans

Only Account Owners and Deploy Owners have permission to the Red Team Scans page in the Aptible Dashboard. It is in the sidebar’s Platform section, after Security & Compliance. From that page, owners can:
  • Request a scan. The request shows the terms, and an owner accepts them to opt the organization in. An organization has one open request at a time.
  • Follow its status: Requested, Running, In review, Delivered, Declined or Canceled.
  • Cancel an open request. The owner can request again afterwards.
  • Download a delivered report. The download shows a link, its expiry time and a password.

​
What teams receive

Results arrive as an encrypted PDF report, which owners download from the Red Team Scans page in the Aptible Dashboard. Each finding in it describes:
  • Its impact: what an attacker could do and to what.
  • What limits it, such as access an attacker would need first.
  • What to fix.

​
Request early access

To request access, contact Aptible Support and ask for early access to Red Team Scans. To report a vulnerability in Aptible itself, see the Responsible Disclosure Policy.
Red Team Scans are in early access. Features and capabilities are subject to change. Contact Aptible Support to provide feedback.

​
Learn more about security on Aptible

Security & Compliance Overview

Learn about the security features included with every Aptible stack

Image and Vulnerability Scanning

Lint Dockerfiles and scan images in CI/CD before deploy