FIRST TOOL. Ask the user for every field before creating an engagement session; this sends no traffic.

Validate a URL against the active session's in-scope and out-of-scope rules without HTTP traffic.

Check friction before live testing: stability, latency, redirect, rate limit, and WAF/CDN hints.

Use Katana at the session rate limit after scope and preflight gates pass.

Run HTTP-only Nuclei high/critical templates under session scope, rules, and rate limit.

Re-run one exact Nuclei template 2-3 times inside the same authorized session.

Import a local HAR/OpenAPI/Postman file; values are redacted and out-of-scope endpoints are rejected.

Register auth profile metadata and secret environment-variable names; actual credentials are never stored.

Replay one imported GET as owner and 1-3 other profiles, twice, without changing IDs or request data.

Find unverified origin IP candidates using in-scope DNS hints and optional historical DNS; sends no IP traffic.

After a fresh user decision, compare one HTTPS edge response with one direct-IP response using the target SNI/Host.

Load a report only when it belongs to the active engagement session.