Start with an authorized test environment
Use a staging application or test fixture you control. Configure the model, target credentials and first-run consent for that environment. Store secrets in your CI provider's secret store, not in the workflow file.
Gate on verified findings
ptai start https://your-authorized-target.example --ci --fail-on verified --no-sync
The gate fails on findings that passed verification. It is not a complete security assessment of the application. Review execution errors separately from finding-based build failures.
To use the deterministic path, add --no-llm. This changes how the investigation
runs; it does not mean every optional scanner is installed automatically.
Export SARIF
Use the engagement ID from the completed run:
ptai export YOUR_ENGAGEMENT_ID --sarif pentest.sarif
This exports verified findings. --sarif belongs to ptai export; it is not a
ptai start option. Arrange your workflow to retain the engagement ID and run
the export even when the finding gate fails, if you want evidence for failed
builds.
Upload the resulting file using your CI provider's SARIF integration. Check the provider's repository permissions and product requirements before enabling code scanning.
Keep reports and artifacts
ptai report YOUR_ENGAGEMENT_ID --format html
The CLI reports the output location. Retain evidence according to your team's data handling policy. Do not upload private target data to public build logs or unrestricted artifacts.