FAQ¶
Can I scan any website?¶
Only systems you own or have written authorization to test. Production instances enforce domain verification for external targets.
What is the difference between Recon, Full, and AI depth?¶
See Scan depths. Recon is fastest; Full adds active testing; AI adds an LLM layer when your operator configured a provider.
Why is a finding not marked CONFIRMED?¶
The confidence pipeline requires independent verification signals for higher tiers. OBSERVED findings may still be actionable.
How do CI pipelines fail builds?¶
Use POST /api/v1/webhook/scan with X-Vex-Key and configure rules under
CI Gate.
Where are API limits documented?¶
Daily scan quotas and API key counts come from GET /api/v1/orgs/plans. HTTP 429
means quota exceeded; HTTP 403 often means plan gating.
Is my data sent to a public LLM?¶
Depends on VEX_LLM_PROVIDER and your contract. See
Sovereignty and Privacy.
Self-hosted vs Vex-hosted?¶
Self-hosted installs use Docker Compose; you
control data residency. Hosted console is at app.vexraptor.com for licensed tenants.