Votal AI

Dapper docs

Dapper is an autonomous AI pentester. Point it at a running app and its source — it finds vulnerabilities, exploits them to prove they're real, and writes a report. Get it running below.

Run it in 4 steps

You need Docker and an Anthropic API key. That’s it.

# 1. Get Dapper
git clone https://github.com/sundi133/dapper.git && cd dapper

# 2. Add your key
cp .env.example .env
echo "ANTHROPIC_API_KEY=sk-ant-..." >> .env

# 3. Add the source of the app you want to test
git clone https://github.com/your-org/your-app.git ./repos/your-app

# 4. Run a pentest (staging/local only — never production)
./dapper start URL=https://staging.your-app.com REPO=your-app

The run goes to the background. Watch it, then read the report:

./dapper logs                    # live progress
open http://localhost:8233       # dashboard
open ./audit-logs/               # report lands here when done

Dapper runs real exploits that can change data. Use staging, sandbox, or local targets only — never production.

Full quickstart → Integrate with CI/CD →

Common tasks

Set up

Install & first run

Prerequisites, install, and your first pentest.

Configure

Test behind a login

Point Dapper at an app with form, SSO, API, or 2FA/TOTP auth.

Integrate

Run it in CI/CD

Trigger a scan on every deploy from GitHub Actions, GitLab, or curl.

Reference

Config & CLI

Every YAML option, CLI flag, and environment variable.

Output

Read the results

What's in audit-logs/: reports, metrics, and logs.

Help

Troubleshooting

Docker, Temporal, local targets, and common errors.