--- description: "Manage production and pre-production environments for comprehensive security testing with Fluid Attacks. Add, edit, and exclude them to tailor your scope." keywords: "test two environments, resources double environment, production environment, add environment, Fluid Attacks security testing, penetration testing as a service, Fluid Attacks documentation" other: private: false title: Manage environments --- # Manage environments import { Image } from "@/components/image"; Fluid Attacks evaluates environments you have appropriately [matched with source code repositories](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Edit_environments). Security testing of environments is done through [dynamic application security testing](https://help.fluidattacks.com/portal/en/kb/articles/what-is-dast) (DAST) and, exclusively in the [Advanced](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing#Continuous_Hacking_plans) plan, [penetration testing as a service](https://fluidattacks.com/product/ptaas/) (PTaaS) and [software reverse engineering](https://fluidattacks.com/product/re/). You are encouraged to have Fluid Attacks test two environments for every repository you add, provided that one of them is the production environment (read the [benefits](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Add_environments) below). ## Know your environments table > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The table listing the environments under evaluation is found in your group's **Scope** section. Its columns show the following information: - **URL:** The URL address of the environment - **Type:** Whether the environment is for a [mobile app](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Manage_mobile_apps) or at a URL - **Status:** The inclusion or exclusion of the environment in the security testing scope; its value can be one of the following: - **Included:** The environment is included for security testing - **Excluded:** The environment is excluded from security testing - **Open event:** A situation prevents the inclusion of the environment for security testing (an icon is provided linking to the event report on the platform) - **Secrets:** Indicates the number of [secrets](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_secrets) (credentials) that you or other members have registered to access the environment - **Connection type:** The custom connection through which Fluid Attacks must access the environment; its value can be one of the following: - **Connector:** Environment is behind a private network; a Cloudflare tunnel is configured - **Egress:** Environment is behind a private network; Fluid Attacks' egress IP addresses are whitelisted - **Legacy:** Access to environment is through a VPN - **N/A:** No custom connection - **Deployment Stage:** Whether the environment is a production or pre-production environment - **Requires Authentication:** Whether or not Fluid Attacks needs credentials to access the environment See environments tested by Fluid Attacks on the platform

See environments tested by Fluid Attacks on the platform

Clicking the downward-facing arrow reveals more information about the environment. Namely, the date it was added, the email address of the group member who added it, and the Git repo(s) to which it is associated. Know environment details on the Fluid Attacks platform

Know environment details on the Fluid Attacks platform

## Add environments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager > [!TIP] > > You can add two environments per Git repository to be tested, **as long as one of the two corresponds to a production environment**. Here is why adding the latter, with **no additional cost**, is recommended: > > 1. It includes comprehensive security testing in the production stage. > 2. In the absence of environment parity, testing the production environment means targeting the system's behavior that is not present in pre-production environments and is what attackers would likely interact with. > 3. Production environments are more stable and less prone to unexpected issues than pre-production ones, which facilitates continuous testing. > > For more information, [read the FAQ](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#How_many_environments_does_Fluid_Attacks_test). > [!CAUTION] > > Environments you have marked as 'production' (step 6) are **not analyzed by the DAST scanner**; they are exclusively analyzed by Fluid Attacks' security analysts in the Advanced plan. > [!TIP] > > A vulnerability found in your production environment is reported for production only when it does not also exist in the other non-production environment you have registered. > [!TIP] > > Below (step 5) are links for guidance on making environments accessible when located within a private network. To add environments to the security testing scope, follow these steps: 1. Access the [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group)'s **Scope** section and click the URL of the active Git repository whose environment you wish to add. Choose repository to add environment on the Fluid Attacks platform

Choose repository to add environment on the Fluid Attacks platform

1. In the pop-up window, choose the **Environments** tab. View linked environments on the Fluid Attacks platform

1. Click on **Add environment**. 1. Select the environment type and provide the required information in each case. Add environment to test on the Fluid Attacks platform

Add environment to test on the Fluid Attacks platform

Here is a short definition of each of the options: - **Mobile App:** The environment to test corresponds to a mobile application. This type requires you to choose the previously added mobile app file. - **URL (microservice, API or web app):** The environment to test is at a URL where the application is deployed. This type requires you to provide the URL. 1. For URL environments, if access is behind a private network, check the condition accordingly. If it is not, leave the Connector and Egress options unchecked. - **[Connector](https://help.fluidattacks.com/portal/en/kb/articles/connector):** Cloudflare Tunnel is configured > [!TIP] > > Read the [Connector connection configuration guide](https://help.fluidattacks.com/portal/en/kb/articles/connector#Installation)! - **[Egress](https://help.fluidattacks.com/portal/en/kb/articles/egress):** Specific IPs need to be whitelisted on your firewall > [!TIP] > > Learn about the [Egress connection requirements](https://help.fluidattacks.com/portal/en/kb/articles/egress#Minimum_requirements)! Specify connection to environment on the Fluid Attacks platform

Specify connection to environment on the Fluid Attacks platform

1. Specify whether or not the environment is a production environment and, if applicable, whether it requires authentication. 1. Click on **Confirm** to add the environment. > [!CAUTION] > > When checking an environment, an HTTP response code 200 usually means that the request was processed correctly. If this code is not received, there may be several reasons why the environment could have problems, which include > > 1. authentication or authorization errors; > 2. data validation errors; > 3. connection or infrastructure problems; > 4. internal server errors. > > A status code other than 200 can indicate something is wrong with the environment you are trying to add. In this case, check that you correctly followed the above configuration steps. After verifying this, you can add your environment disregarding the platform warning. Keep in mind that the DAST scanner cannot analyze your environment if it is unreachable. > [!TIP] > > Remember to [provide the credentials](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Manage_secrets) to your pre-production and production environments. ## Manage environment secrets > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager On the platform, you can securely manage secrets (credentials) that grant Fluid Attacks access to environments in order to test them. Follow these steps to add secrets: 1. Access the group's **Scope** section and click the environment's URL. 1. Click the **Add secret** button. Add environment secret on the Fluid Attacks platform

Add environment secret on the Fluid Attacks platform

1. Add as **Key** the kind of secret it is (e.g., token) and as **Value** the actual secret. Optionally, provide a description that can help its use. Manage environment secrets on the Fluid Attacks platform

Manage environment secrets on the Fluid Attacks platform

1. Click on **Confirm**. The environment secret is added to the table and made available for Fluid Attacks to view. You can **view**, **edit** or **remove** only the secrets you added. View, edit, or remove secrets on the Fluid Attacks platform

View, edit, or remove secrets on the Fluid Attacks platform

## Edit environments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager You may edit the information on [connection type](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Know_your_environments_table) and whether the environment is a production environment. These are the steps: 1. Access the group's **Scope** section and click the URL of the active Git repository whose environment you wish to edit. 1. Switch to the **Environments** tab. 1. From the **Actions** column, click on the edit icon. Edit environment on the Fluid Attacks platform

Edit environment on the Fluid Attacks platform

1. Make the desired changes and click on **Confirm**. Edit production environment on the Fluid Attacks platform

## Remove environments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager In order to remove an environment, follow these steps: 1. Click on the Git repository to which the environment is linked. 1. Switch to the **Environments** tab. 1. From the **Actions** column, click the trash can icon corresponding to the environment you wish to delete. Remove environment on the Fluid Attacks platform

Remove environment on the Fluid Attacks platform

1. Confirm removal. Confirm environment removal on the Fluid Attacks platform

## Move environments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** Group Manager You can move environments across Git repositories within the same group or in a different one. These are the steps: 1. Access the group's **Scope** section and click the URL of the active Git repository whose environment you wish to move. 1. Switch to the **Environments** tab. 1. From the **Actions** column, click on the move icon. Move environment on the Fluid Attacks platform

Move environment on the Fluid Attacks platform

1. Select the target group. Move environment to a group on the Fluid Attacks platform

1. Type in the search box either part of the target repo's URL, branch or nickname, to activate the dropdown menu from which you can choose the repo. Change environment root on the Fluid Attacks platform

Change environment root on the Fluid Attacks platform

1. Click **Confirm**. ## Exclude Environments > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User or Group Manager > [!CAUTION] > > **Warnings:** > > 1. Excluding a subpath implies it is not considered in vulnerability analysis. > 2. Excluding a main path automatically excludes all of its subpaths. > 3. You cannot activate a subpath if its main environment is inactive. If you want to exclude from security testing a subpath of a specific environment, follow the steps below: 1. Go to your [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group)'s **Scope** section. 1. Add the subpath you wish to exclude as you would add an environment to test. To learn how to do the latter, read [Add environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Add_environments). Add environment to exclude on the Fluid Attacks platform

Add environment to exclude on the Fluid Attacks platform

1. Click **Confirm**. 1. In the table, locate the added subpath and switch the corresponding toggle in the **Exclusion status** column to off. Exclude environment from tests on the Fluid Attacks platform

Exclude environment from tests on the Fluid Attacks platform

1. Click on **Confirm** to apply the exclusion. Confirm environment exclusion on the Fluid Attacks platform

> [!TIP] > > **Note:** Make sure the main path exists before excluding a specific path. ## Manage mobile apps > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager ### Add mobile apps to test To add mobile apps for testing (e.g., .aab, .ipa, .apk), you can refer to the mobile app distribution platform where it is located or upload the app file directly. Choosing the latter, you can either upload the file in the **Add environment** window or upload it in **Files** and then add an environment linking to that file. Here are the steps to upload your mobile app starting from the **Add environment** window: 1. Access the group's **Scope** section and click on the URL of the repository related to the mobile app. If you have not yet added the repository, do it following the steps in [Add a new Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository). 1. Switch to the **Environments** tab and click on **Add environment**. 1. Choose 'Mobile App' as the environment type. 1. Choose a mobile app distribution platform or indicate that you will upload the file directly. The supported platforms are TestFlight, Firebase, App Store Connect, and Google Play Store. Choose mobile app platform on the Fluid Attacks platform

Choose mobile app platform on the Fluid Attacks platform

When choosing distribution platforms, you need to indicate your app's name. And if you choose Firebase, you are also asked to specify the OS for which the app is made (Android or iOS). Choose app operating system on the Fluid Attacks platform

Choose app operating system on the Fluid Attacks platform

You are required to grant access to [continuous@fluidattacks.org](mailto:continuous@fluidattacks.org), [squad@fluidattacks.com](mailto:squad@fluidattacks.com), and [continuousatfluidattacks@gmail.com](mailto:continuousatfluidattacks@gmail.com), depending on the chosen distribution platform. Click on the toggle to confirm this step. Confirm emails granted access on the Fluid Attacks platform

Confirm emails granted access on the Fluid Attacks platform

If you are uploading the mobile app file directly, you can select a preuploaded file (steps further below) or upload the file. Its size must not exceed 4.88GB Upload a mobile app on the Fluid Attacks platform

Upload a mobile app on the Fluid Attacks platform

Additionally, for Fluid Attacks to perform security testing in your environment, you must upload **two versions** of the application at different times: one with and another without **RASP controls** (e.g., root detection, emulator detection, SSL pinning). Select the option that corresponds to the file in question. Select whether the file version includes RASP controls on the Fluid Attacks platform

Select whether the file version includes RASP controls on the Fluid Attacks platform

1. Lastly, specify if it is a production environment. Specify production environment on the Fluid Attacks platform

1. Click on **Confirm**. As an alternative, add the mobile app in **Files** and then link it to an environment: 1. Access the group's **Scope** section and scroll down to **Files**. View files section on the Fluid Attacks platform

View files section on the Fluid Attacks platform

1. Click on **Add**. 1. Click on the **Add file** button and choose the mobile app file. Remember, its size must not exceed 4.88GB. Add mobile app file on the Fluid Attacks platform

Add mobile app file on the Fluid Attacks platform

1. Click on **Confirm**. Your file should now be visible in the table. 1. Scroll up to **Git Repositories**. If you have not yet added the repository related to the mobile app in question, do it following the steps in [Add a new Git repository](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Add_a_new_Git_repository). 1. Click on the repository URL and choose **Environments > Add environment**. 1. Choose **Mobile App** as the **environment type**, then select the corresponding file from **Select a binary file**, and specify if it includes **RASP controls** and if it is a **production environment**. Add mobile app environment on the Fluid Attacks platform

Add mobile app environment on the Fluid Attacks platform

- Click on **Confirm**. ### Update mobile app file > [!TIP] > > The platform does not allow replacing a file with one of a different extension. If you have added your mobile app through TestFlight, Firebase, App Store Connect, and Google Play Store, Fluid Attacks can always get the latest version of your app on those platforms. Otherwise, follow these steps to add a newer version of your mobile app. **Do not delete the file**, as this causes the platform to mark any 'Open' vulnerabilities found in the app as 'Closed' (this is undesirable, as you want us to continue testing the app). 1. Go to **Scope** **>** **Files**. 1. Click on the mobile app file. 1. Click on **Add file** and upload the newer app version. Update mobile app file on the Fluid Attacks platform

Update mobile app file on the Fluid Attacks platform

1. Click on **Replace file**. 1. Read the warning message. You acknowledge that the file is linked to an environment, vulnerabilities found in the older file can refer to the newer file, and the latter corresponds to the same mobile app. If you wish to proceed, click on **Confirm**. Confirm file update on the Fluid Attacks platform

Confirm file update on the Fluid Attacks platform

### Remove mobile app file > [!CAUTION] > > Removal causes 'Open' vulnerabilities found in the file to be marked as 'Closed'. Please ensure that you would not rather [update the file](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Update_mobile_app_file). If you are removing a file associated with an environment, you get the following message after step 3 below. View file removal message on the Fluid Attacks platform

View file removal message on the Fluid Attacks platform

In this case, follow the steps described in [Remove environments](https://help.fluidattacks.com/portal/en/kb/articles/manage-environments#Remove_environments) instead. This should be done by a [Group Manager](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles#Group_Manager_role). As the message says, removing the environment also removes the mobile app file. If the file is not associated with an environment, do the following: 1. Go to **Scope** **>** **Files**. 1. Click on the file to be removed. 1. Click on **Remove**.

1. Click on **Confirm**. Confirm file deletion on the Fluid Attacks platform

> [!TIP] > > **Free trial**Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).