> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Testing your app's security with Tenzai

> Connect Tenzai to run an AI penetration test on your published app. It attacks your live app like a real attacker and sends the report to your Tenzai account.

Tenzai is an AI penetration tester that attacks your published app the way a real attacker would, then reports what it managed to do. It adds to your app's security scan: the scan checks your code, and a penetration test (pentest) checks how your live app holds up against real attacks. To get started, connect Tenzai once for your workspace, then run a pentest from your app's **Security** page.

![A screenshot of the Tenzai for Base44 page, which offers continuous security testing for your Base44 apps](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-for-base44.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=5868d88c7be855d4c442e2c7e7c009e9)

Tenzai for Base44

> [!WARNING]
>
> You need the [Builder plan or higher](https://docs.base44.com/Account-and-billing/Billing-and-plans.md) to test your app's security with Tenzai.

***

## How it works

You start a pentest from Base44, and Tenzai runs it on your own Tenzai account. Base44 gives Tenzai a temporary test login for your app, so it can test the pages people see after they sign in as well as your public pages. Your own login details are never shared.

When the test finishes, you get an email and the full report appears in your Tenzai dashboard. Pentests are billed to your Tenzai account and don't use Base44 credits.

> [!NOTE]
>
> **When to run a test:**
>
> A test only covers the version of your app that's published when it runs, so it isn't a one-time check. Run a test:
>
> * Before you launch your app.
> * After big changes, such as adding sign-in, payments, or new user roles.
> * When a customer or audit asks for one.

***

## Step 1: Connect Tenzai

Connect Tenzai once for your workspace. After it's connected, workspace owners and admins can run pentests on any app in the workspace.

> [!TIP]
>
> **Before you begin:**
>
> * You need to be a workspace owner or admin to connect Tenzai and run pentests.
> * You need a Tenzai account and an access key. If you don't have one, you can register while you connect.

**To connect Tenzai:**

1. Click **Connectors** in your workspace sidebar.
2. Click **Add connector**.
3. Search for **Tenzai** and click it.
4. Do one of the following:

> **Connect your Tenzai account**
>
> If you already have a Tenzai account, use the access key from your Tenzai account.
>
> 1. Paste your Tenzai access key into the **Access Key** field.
> 2. Click **Connect**.

> **Register for a Tenzai account**
>
> If you don't have a Tenzai account yet, register from the **Connect Tenzai** window. Tenzai sets up a dedicated Tenzai organization for your workspace and gives you an access key. Your invitation link works once and expires automatically.
>
> 1. Click **Click here to register**. The **Tenzai for Base44** page opens.
> 2. Under **Accept your invitation**, click **Continue securely**.
> 3. Under **Tell us about your organization**, enter your **First name**, **Last name**, and **Work email**. You can also add a **Company or team**.
> 4. Select the **I'm authorized to connect this workspace** checkbox.
> 5. Click **Create my Tenzai access**.
> 6. Under **Your Tenzai access token**, click **Copy token**. Tenzai shows the token only once, so copy it now.
> 7. Return to the **Connect Tenzai** window and paste the token into the **Access Key** field.
> 8. Click **Connect**.

![A screenshot of the Connect Tenzai window with an access key pasted into the Access Key field](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-connect.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=e2f8cdfcd182b3962626730f600931d8)

Connecting your workspace to Tenzai

> [!NOTE]
>
> **About connecting Tenzai:**
>
> * If your workspace sidebar doesn't show **Connectors**, open your workspace settings and go to the connectors page under build tools. Tenzai is listed with the connectors for app builders, with an **Add** button.
> * Your access key is stored encrypted and isn't shown again after you save it.

***

## Step 2: Run a pentest

A pentest runs against the version of your app that's currently published.

> [!TIP]
>
> Your app needs an up-to-date security scan before you can start a pentest. If your issues on the Security page show **Out of date**, click **Run Security Scan** and wait for it to finish. The pentest button stays grayed out until then.

**To run a pentest:**

1. Click **Dashboard** in your app editor.
2. Click **Security**.
3. On the **Tenzai penetration test** card, click **Run penetration test**.
4. Review the details in the **Run pentest** dialog.
5. Select the **I understand this test may create or change test data** checkbox.
6. Click **Run pentest**.

![A screenshot of the Run pentest window with the confirmation checkbox selected and the Run pentest button ready](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-run-pentest-dialog.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=6261d3cf699e0421f37757bd382665ec)

Confirming a test in the Run pentest window

> [!WARNING]
>
> A pentest sends real attacks to your published app. It runs on your test data, not your production data, but it may create or change test records. Avoid publishing changes while the test runs, because the report won't include them.

***

## Step 3: Review results

While a test runs, the Tenzai card shows when it started, and **Run penetration test** changes to **Running...**. A test can take several hours, and you get an email when it's done.

![A screenshot of the Tenzai penetration test card showing when the test started and a Running status](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-test-running.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=e18b7bfa2049477acdb3c9e590559151)

A Tenzai test in progress

### Opening your report

When a test finishes, Tenzai emails you the full report as a PDF attachment. You can also open it from your Tenzai account at any time.

**To open your report:**

1. Click **Dashboard** in your app editor.
2. Click **Security**.
3. On the **Tenzai penetration test** card, click **Go to Tenzai**.

![A screenshot of the app's Security page with the Go to Tenzai button outlined on the Tenzai penetration test card](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-go-to-tenzai.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=2d40b2c723f55de1489f0b495fe9c3bf)

Opening your Tenzai account from the Security page

### Reading the summary

The report opens with a summary of what Tenzai found: an overall risk level, how many parts of your app it tested, and every finding sorted by severity, from **Critical** to **Low**.

![A screenshot of a Tenzai report summary showing a High risk level, 10 findings, 44 endpoints tested, and the findings table](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-report-summary.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=a3117a43e2bd4b2138337678fc2dd593)

The summary at the start of a Tenzai report

### Reading a finding

Each finding gets its own section. It shows the severity, which parts of your app are affected, and whether the issue is still open, followed by:

* **Impact:** What an attacker could do with it.
* **Attack path and evidence:** How Tenzai did it, step by step, with the requests it sent as proof.
* **Remediation:** How to fix it.

In the example below, Tenzai found that any signed-in user could read and change trips that belonged to other users. Findings like this usually mean the app's data needs permission rules, so each person only sees and edits their own records. Learn more about [setting data permissions](https://docs.base44.com/Setting-up-your-app/Managing-security-settings.md).

![A screenshot of a high severity finding in a Tenzai report, with its classification, score, affected endpoints, and Open status](https://mintcdn.com/base44/y1KV90zYomhQxPau/images/tenzai-report-finding.png?fit=max\&auto=format\&n=y1KV90zYomhQxPau\&q=85\&s=724affcaf5f0152bb751fa8fc51496bf)

An example finding in a Tenzai report

### Fixing the findings

Work through the findings from most to least severe, and test again once you've fixed them.

> [!WARNING]
>
> Your report shows exactly how to attack your app. Keep it private, and only share it with people who help you fix your app.

**To fix what Tenzai finds:**

1. In your app editor, switch the AI chat to **Discuss**, paste the finding's **Impact** and **Remediation**, and ask the AI how to fix it in your app.
2. Switch to **Build** and ask the AI to make the fix.
3. Run a [security scan](https://docs.base44.com/Setting-up-your-app/running-a-security-scan.md) to check your app.
4. Publish your app, then run another pentest to confirm the issues are fixed.

***

## Managing the connection

Workspace owners and admins can update or remove the Tenzai connection at any time. If your workspace sidebar doesn't show **Connectors**, open the connectors page from your workspace settings instead.

### Updating your access key

Update your access key if you create a new one in Tenzai, or if Tenzai stops accepting the one you saved.

**To update your Tenzai access key:**

1. Click **Connectors** in your workspace sidebar.
2. Find **Tenzai**, then click **View**.
3. Under **Connections**, click **Edit** next to the connection.
4. Enter your new access key.
5. Click **Save Changes**.

### Deleting the connection

Deleting the connector stops pentests for every app in the workspace.

**To delete the Tenzai connector:**

1. Click **Connectors** in your workspace sidebar.
2. Find **Tenzai**, then click **View**.
3. Under **Connections**, click **Delete Connector** next to the connection.
4. Review the confirmation message, then click **Delete Connector** to confirm.

***

## FAQs

Click a question below to learn more about running pentests with Tenzai.

> **Why can't I run a pentest?**
>
> The **Run penetration test** button is available only when all of these are true:
>
> * You're a workspace owner or admin. Other members don't see the Tenzai card.
> * Your app is published.
> * Your app has a security scan on its current version.
> * No other pentest is already running for the app.
>
> Full-stack apps don't support pentests.

> **What if Tenzai doesn't accept my access key?**
>
> If Tenzai doesn't accept your access key, or the key isn't allowed to start scans, check the key and its permissions in your Tenzai account. Then [update your access key](#updating-your-access-key) in Base44.

> **How is Tenzai different from Wiz?**
>
> [Wiz](https://docs.base44.com/Setting-up-your-app/scanning-with-wiz.md) adds checks to your security scan by reviewing your app's dependencies and code. Tenzai attacks your published app while it runs, to show what an attacker could actually do. You can use both.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.