Some problems only show once you are signed in. On a website or API asset, the Authentication tab holds profiles: a dedicated test account's credentials (HTTP basic, a session cookie, a bearer token, an API key or a login form). Your plan must include authenticated scanning and you need the matching permissions.
Rules we apply
- Use a least-privilege test account, never an administrator or personal account.
- Credentials are encrypted when saved and can never be viewed again. To change them use Rotate; to remove them use Delete.
- A profile lists the origins it may be sent to (up to five: the asset's own host or another verified asset). Credentials are never sent anywhere else, and never with DNS, TLS or port checks.
- Validate signs in once so you can check the profile before relying on it.
- Only read-only requests are sent and pages are not rendered in a browser. JavaScript-only logins, MFA, CAPTCHA and single sign-on are not covered.
Launching
Choose the profile in the Authentication step and tick the three confirmations: you are authorized, it is a dedicated test account and you accept the extra audit-log entries. A manual launch needs the confirmation each time. A scan that signed in cannot be retried by anyone: launch it again and confirm again.
What you will see
- If the login fails or the session ends, the scan says authenticated coverage incomplete instead of showing a clean result.
- Findings seen while signed in are marked Observed while authenticated.
- Credentials are never sent over a connection TasScan could not verify; the scan then ends as inconclusive, not as a pass.