Configuring your first target

A target is the smallest unit Pentrova can scan. One target is one logical application or one OpenAPI surface. Configure it once and every scan against it inherits the scope, auth, and environment you set here.

Minimum required fields#

target:
  name: "staging-api"
  base_url: "https://staging.api.example.com"
  environment: "staging"
  scope:
    include:
      - "/v1/**"
    exclude:
      - "/v1/admin/danger/**"

Pentrova only scans paths you explicitly include. The exclude list is honoured absolutely — an excluded path is never reached, even when testing would otherwise route there.

Safe environments only#

Targets must point at staging, QA, or a purpose-built sandbox. Scanning production is supported but requires a separate, explicitly opt-in configuration with additional safety constraints.

Additional scope hints#

Optional fields narrow coverage further: rate_limit caps concurrent requests, max_duration caps the scan window, and tags let you group targets under release gates.

rate_limit:
  rps: 20
max_duration: "30m"
tags: ["release-gate", "tier-1"]

Evidence retention#

Pentrova keeps a target’s settings, findings and reports while your account is active. The raw evidence captured from the target follows shorter rules:

Captured credential values (cookies, Authorization and API-key headers, and tokens read from browser storage) are masked 7 days after the scan ends.
Sign-in screenshots are cleared after 30 days, unless a workspace owner changes this in the workspace settings.
Request and response bodies in the traffic history are hidden after 90 days.
The rest of the raw material captured from the target is deleted 90 days after the scan. The finding and its redacted proof stay.

Free scans are deleted on day 90. When an account closes, its data is deleted 90 days after closing, and an explicit deletion request is completed within 30 days. Backups are weekly copies kept for 35 days, plus point-in-time restore over the last 7 days; there are no monthly copies.

Honest limitation: the first three rules above run automatically today. The other deletions in this schedule are not automated yet; until they are, data is deleted on request. The platform privacy policy sets out the full schedule.