> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Getting Started

> Get started with Pensar Console and run your first penetration test

## Overview

Welcome to Pensar Console! This guide will walk you through creating your workspace, connecting your source code, and running your first autonomous penetration test.

## Create Your Workspace

Your workspace represents your organization in Pensar Console. It's where you'll access the application, add repositories, run tests, and view results.

#### Sign In

Visit [console.pensar.dev](https://console.pensar.dev) and sign in using
Google or GitHub authentication.

#### Create Workspace

If you don't have an existing workspace, you'll be redirected to create one.
Provide a workspace name (letters, numbers, spaces, and hyphens only, max 64
characters).

#### Connect Source Code (Optional)

After creating your workspace, you'll be guided to optionally connect a VCS
provider to enable source-code-aware testing and auto-remediation.

> **Success**
>
> Once your workspace is created, you can invite team members, add repositories,
> and start running penetration tests.

## Connect Your Source Code

During the onboarding process, you have several options for providing source code access. Source code is strongly recommended — it enables Pensar's full [hybrid testing methodology](/console/features/hybrid-testing) and [auto-remediation](/console/features/auto-remediation) capabilities.

#### Connect GitHub

Install the Pensar GitHub app during onboarding:

1. Select the repository scope (all repositories or specific ones)
2. Authorize the Pensar GitHub app
3. Add repositories through the Pensar Console

The GitHub integration enables:

* Automatic repository analysis
* Event-based scanning on pull requests
* Auto-remediation with pull request creation

#### Connect GitLab

Create a GitLab Personal Access Token (PAT):

1. Navigate to your [GitLab settings](https://gitlab.com/-/user_settings/personal_access_tokens)
2. Create a PAT with these permissions:
   * `api`
   * `read_api`
   * `read_user`
   * `read_repository`
3. In Pensar Console, navigate to integrations
4. Paste your PAT and connect

> **Info**
>
> For self-hosted GitLab, provide your GitLab host URL in the integration form.

#### Connect Bitbucket

Connect your Bitbucket workspace:

1. Create a Bitbucket App Password with repository read permissions
2. In Pensar Console, navigate to integrations
3. Enter your credentials and connect

The Bitbucket integration enables repository analysis and automatic security scanning.

#### Upload Zip File

Upload source code directly as a zip file:

1. On the **Repository** step of onboarding, choose to upload source code instead of connecting a VCS provider
2. Prepare a zip file containing your application source code
3. Upload the file through the console

This option is ideal for:

* Testing without VCS integration
* One-time security assessments
* Internal applications not in version control

## Onboarding Your Workspace

There's no separate "project" to create. After your workspace exists, an onboarding wizard walks you through everything the agent needs. For the best results, provide as many sources as possible — domains, source code, and authentication credentials — so the agent can leverage the full [hybrid testing methodology](/console/features/hybrid-testing).

#### Add a Domain

Add the domain where your application is deployed. Domains are
[verified](/console/domains/adding-domains) (via DNS TXT records) so the
agent can validate vulnerabilities with live exploitation.

#### Connect a Repository

Connect a repository from your VCS provider, or upload your source code as a
zip file. Source code is strongly recommended — it unlocks code-level
findings and [auto-remediation](/console/features/auto-remediation) — but you
can skip it and continue with domains only.

#### Configure Authentication

Provide [authentication credentials](/console/features/authentication)
(username/password or bearer tokens) so the agent can test authenticated
endpoints. The agent tests with and without credentials to find
authentication bypass and authorization flaws.

#### Run Recon

Pensar runs reconnaissance to map your [attack surface](/console/features/attack-surface) — discovering endpoints,
services, and entry points across your domains and source code.

> **Info**
>
> The wizard includes a few more optional steps — threat modeling, inviting your
> team, and notification preferences — before a final review. You can revisit any
> of them later from your workspace settings.

## Run Your First Pentest

Once onboarding is complete, launch a penetration test from your workspace under **Pentests → Launch Pentest**. The agent runs inside an isolated sandbox, analyzes any connected source code, maps the attack surface, and tests your live domains using the [hybrid methodology](/console/features/hybrid-testing).

> **Info**
>
> Don't have source code to provide? You can still run a pentest with just
> domains — the agent will perform reconnaissance-based testing against your live
> endpoints. But we strongly encourage connecting your repository for maximum
> coverage and precision.

## Understanding Test Results

Once your penetration test completes, you'll have access to comprehensive results:

#### Vulnerability Reports

View detailed information about identified security issues, including
severity, impact, and affected endpoints.

#### Proof of Concepts

Each vulnerability includes a proof-of-concept (POC) you can use to
replicate the issue and verify fixes.

#### Remediation Guidance

Get actionable remediation advice for each vulnerability, including code
examples and best practices.

#### Export Reports

Download comprehensive penetration test reports in various formats for
compliance and documentation.

## Next Steps

Now that you've set up your workspace and run your first pentest, explore these features:

#### [Attack Surface](/console/features/attack-surface)

Learn how Pensar identifies and maps your application's attack surface.

#### [Hybrid Testing](/console/features/hybrid-testing)

Learn how hybrid pentesting combines source analysis with live exploitation.

#### [Auto Remediation](/console/features/auto-remediation)

Enable automatic vulnerability fixes with AI-generated patches.

## Need Help?

If you have questions or need assistance, don't hesitate to [contact our support team](mailto:team@pensar.dev).