> ## Documentation Index
> Fetch the complete documentation index at: https://docs.withgiga.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Shallow Audits

> OWASP Top 10 coverage with proof-of-concept exploitation, in 30 minutes

# Shallow Audits

A **shallow audit** is the fastest engagement mode. It covers OWASP Top 10 vulnerabilities with proof-of-concept exploitation only — no post-exploitation, no persistence, no exfiltration testing.

| Property          | Value                                         |
| ----------------- | --------------------------------------------- |
| Default duration  | 30 minutes                                    |
| Methodology scope | OWASP Top 10 + PoC                            |
| Post-exploitation | Disabled                                      |
| Best for          | CI/CD gates, pre-launch checks, smoke testing |

## What it covers

Shallow mode runs phases 1–6 of the [attack methodology](/how-it-works/methodology):

1. Passive reconnaissance
2. Subdomain enumeration
3. Port and service scanning
4. Web fingerprinting
5. Vulnerability scanning
6. Proof-of-concept exploitation (read-only)

It stops there. The agent will confirm a vulnerability exists and capture evidence, but it will not pivot, escalate privileges, attempt persistence, or exfiltrate data.

## What it skips

To stay fast and CI-safe, shallow audits do **not**:

* Run auth brute force or credential stuffing
* Attempt SQL injection beyond detection-level payloads
* Pivot from one finding to another
* Exfiltrate or modify data
* Test post-exploitation chains

If you need the full chain, use a [Deep audit](/audits/deep).

## When to use

* **CI/CD integration** — gate deploys on critical findings without blocking the pipeline for hours
* **Pre-launch checks** — verify a new release before going to production
* **Continuous coverage** — schedule daily or hourly runs against production
* **Regression testing** — verify a previously remediated finding is still gone

## Running a shallow audit

**API**

```bash theme={null}
curl -X POST https://api.withgiga.ai/api/workspaces/{workspaceId}/audits \
  -H "Authorization: Bearer $GIGA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "shallow",
    "targets": ["acme.example.com"]
  }'
```

**Dashboard**

1. Open the workspace
2. Click **New Audit**
3. Select **Shallow** mode
4. Confirm targets
5. Click **Launch**

## Expected output

A typical shallow audit produces 0–15 findings depending on the target's surface area. Findings will be predominantly **Medium** and **Low** severity, with occasional **High** for clear misconfigurations.

For exposed RCE or auth bypass — where deeper exploitation would be needed to confirm impact — the agent will note the discovery but mark severity conservatively. Run a [Deep audit](/audits/deep) on the same target to fully validate.

## Next steps

<Columns cols={2}>
  <Card title="Deep Audits" icon="layer-group" href="/audits/deep">
    Full 10-phase chain including post-exploitation.
  </Card>

  <Card title="Findings" icon="circle-exclamation" href="/audits/findings">
    Understand how findings are structured and prioritized.
  </Card>
</Columns>