Environments

Last updated: Oct 26, 2026

---

Fluid Attacks tests the environments that you matched with source code repositories correctly. Fluid Attacks tests environments with these techniques:

Environments table

The table of the environments in evaluation is in the Scope section of your group. Its columns show this information:

• URL: The URL address of the environment
• Type: The type of resource (its value can be one of these):
  • Frontend Web Application
  • API
  • Cloud (CSPM)
  • Mobile app
  • Docker images
• Status: If the security testing scope includes or excludes the environment (its value can be one of these):
  • Included: The security testing includes the environment
  • Excluded: The security testing excludes the environment
  • Open event: A condition prevents the inclusion of the environment in the security testing (an icon links to the event report on the platform)
• Secrets: The number of secrets (credentials) that you or other members registered to access the environment
• Connection type: The custom connection that Fluid Attacks must use to access the environment (its value can be one of these):
  • Connector: The environment is in a private network with a configured Cloudflare tunnel
  • Egress: The environment is in a private network that allows the egress IP addresses of Fluid Attacks
  • N/A: No custom connection
• Deployment Stage: If the environment is a production or pre-production environment
• Requires authentication: If Fluid Attacks needs credentials to access the environment

Click the arrow that points down to see more information about the environment. The details are the date when a group member added it, the email address of that member, and its Git repositories.

Add environments

You can add two environments to test for each Git repository, if one of the two is a production environment. Fluid Attacks recommends the production environment, which does not cost more, for these reasons:

• With it, Fluid Attacks can test the production stage directly, in addition to the pre-production stage. The result is a full view of risk exposure.
• If the environments are not equal, the test of the production environment targets the system behavior that pre-production environments do not have. Attackers possibly interact with this behavior.
• Production environments are more stable and have a smaller number of unexpected problems than pre-production environments. This makes continuous testing easier.

For more information, read the FAQ.

To add environments to the security testing scope, do these steps:

1. Go to the Scope section of the group. Then, click the URL of the active Git repository of the environment to add.

   

2. In the pop-up window, select the Environments tab.

   

3. Click Add environment.

4. Select the environment type and give the necessary information.

   

   This is a short definition of each option:

   • API: The environment to test is an API at a URL where it is deployed. For this type, give the URL.
   • Cloud (CSPM): You add your AWS environment for tests with cloud security posture management. For this type, use this guide.
   • Frontend Web Application: The environment to test is at a URL where the application is deployed. For this type, give the URL.
   • Mobile Application: The environment to test is a mobile application. For this type, select the mobile app file that you added before.
   • Docker image: The environment to test is a container image. For this type, give the image URI. If authentication is necessary for your image repository, also give the credentials to access it.

5. For Frontend Web Application and Docker image environments, select the connection method. If the access is through a private network, select the applicable condition. If it is not, select 'None (public environment)'.

   • Connector: Cloudflare Tunnel is configured

     Read the Connector connection configuration guide!

   • Egress: Your firewall must allow the IP addresses of Fluid Attacks

     Learn about the Egress connection requirements!

     

6. Select if the environment is a production environment.

   

7. For Frontend Web Application environments, select if authentication is necessary for the environment. If you enable this option, the platform disables DAST testing to reduce false positives.

   

   Warning if authentication is needed

8. Click Add environment at the bottom of the form.

When the platform checks an environment, an HTTP response code 200 usually means that the request was processed correctly. If the platform does not get this code, the environment can have problems. Some possible causes are:

• Authentication or authorization errors
• Data validation errors
• Connection or infrastructure problems
• Internal server errors

Manage environment secrets

On the platform, you can securely manage secrets (credentials) that give Fluid Attacks access to environments to test them. To add secrets, do these steps:

1. Go to the Scope section of the group. Then, click the URL of the environment.

2. Click Add secret.

   

3. In Key, write the type of secret, for example, token. In Value, type the secret. For an API environment, Key is the name of the header that carries the secret, such as Authorization for Bearer Token. Optionally, write a description to help with its use.

   

4. Click Confirm.

The environment secret shows in the table, and Fluid Attacks can see it. You can view, edit, or remove only the secrets that you added. You cannot remove the last secret of an environment that uses Bearer Token or Custom (key + value) until you change its type to Public (no authentication).

Edit environments

You can edit the connection type, if the environment is a production environment, and, for Frontend Web Application environments, if authentication is necessary for it. Do these steps:

1. Go to the Scope section of the group. Then, click the URL of the active Git repository of the environment to edit.

2. Switch to the Environments tab.

3. In the Actions column, click the edit icon.

   

4. Make the changes. Then, click Save changes.

   

Remove environments

To remove an environment, do these steps:

1. Click the Git repository of the environment.

2. Switch to the Environments tab.

3. In the Actions column, click the trash can icon of the environment to remove.

   

4. Confirm the removal.

   

Move environments

You can move environments between Git repositories of the same group or of a different group. Do these steps:

1. Go to the Scope section of the group. Then, click the URL of the active Git repository of the environment to move.

2. Switch to the Environments tab.

3. In the Actions column, click the move icon.

   

4. Select the target group.

   

5. In the search box, type part of the URL, branch, or nickname of the target repository. Then, select the repository in the drop-down menu.

   

6. Click Confirm.

Exclude environments

To exclude a subpath of an environment from security testing, do these steps:

1. Go to the Scope section of your group.

2. Add the subpath to exclude as you add an environment to test. To learn how, read the "Add environments" section.

   

3. Click Add environment at the bottom of the form.

4. In the table, find the added subpath. Then, set its toggle in the Exclusion status column to off.

   

5. Click Confirm to apply the exclusion.

   

Manage mobile apps

Add mobile apps to test

To add mobile apps for testing, for example, .aab, .ipa, or .apk, use one of these methods:

• Use the mobile app distribution platform of the app.
• Upload the app file in the Add environment window.
• Upload the app file in Files. Then, add an environment that links to that file.

To upload your mobile app from the Add environment window, do these steps:

1. Go to the Scope section of the group. Then, click the URL of the repository of the mobile app. If you did not add the repository before, do the steps in "Add a new Git repository".

2. Switch to the Environments tab. Then, click Add environment.

3. Select "Mobile Application" as the environment type.

4. Select a mobile app distribution platform, or select the option to upload the file directly. The supported platforms are TestFlight, Firebase, App Store Connect, and Google Play Store.

   

   If you select a distribution platform, type the name of your app. If you select Firebase, also select the OS of the app (Android or iOS).

   

   You must give access to [email protected], [email protected], and [email protected], as applicable to the selected distribution platform. Click the toggle to show that you did this step.

   

   If you upload the mobile app file directly, you can select a file that you uploaded before (read the subsequent steps) or upload the file. The maximum file size is 4.88 GB.

   

   For security testing of your environment, upload two versions of the application at different times. One version must have RASP controls (for example, root detection, emulator detection, and SSL pinning). The other version must not have them. Select the applicable option for the file.

   

5. Select if it is a production environment.

   

6. Click Confirm.

As an alternative, add the mobile app in Files and link it to an environment:

1. Go to the Scope section of the group. Then, scroll down to Files.

   

2. Click Add.

3. Click Add file. Then, select the mobile app file (maximum size: 4.88 GB).

   

4. Click Confirm. Your file shows in the table.

5. Scroll up to Git Repositories. If you did not add the repository of the mobile app before, do the steps in "Add a new Git repository".

6. Click the repository URL. Then, select Environments > Add environment.

7. Select Mobile Application as the environment type. Then, select the file in Select a binary file. Also, select if it includes RASP controls and if it is a production environment.

   

8. Click Add environment at the bottom of the form.

Update mobile app file

If you added your mobile app through TestFlight, Firebase, App Store Connect, or Google Play Store, Fluid Attacks can always get the latest version of your app on those platforms. If not, do these steps to add a newer version of your mobile app.

Do not remove the file. If you remove it, the platform changes the status of the "Open" vulnerabilities of the app to "Closed". You do not want this, because Fluid Attacks must continue to test the app.

1. Go to Scope > Files.

2. Click the mobile app file.

3. Click Add file. Then, upload the newer app version.

   

4. Click Replace file.

5. Read the warning message. When you click Confirm, you accept these points:

   • The file links to an environment.
   • The vulnerabilities of the previous file can refer to the newer file.
   • The newer file is for the same mobile app.

   To continue, click Confirm.

   

Remove mobile app file

If you remove a file that links to an environment, you get this message after step 3 below.

In this case, do the steps in "Remove environments", and not the steps that follow. A Group Manager must do this. As the message says, when you remove the environment, you also remove the mobile app file.

If the file does not link to an environment, do these steps:

1. Go to Scope > Files.

2. Click the file to remove.

3. Click Remove.

   

4. Click Confirm.