> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests/private-networks.md).

# Private Networks

Run a pentest from a machine or self-hosted CI runner that can reach the target, using the public CLI's `--local` mode. Docker executes the DAST image locally; findings and scan information still flow to your hosted Nullify tenant. Local target access does not mean the engagement is offline or that all data stays inside your network.

## Requirements

* A working Docker daemon and enough capacity for the DAST container.
* DNS and network access from the container to the target.
* Outbound access to the Nullify API and the configured image registry, plus the services required by the scanner.
* A Nullify identity permitted to run the engagement and credentials authorized for the target.

```bash
nullify pentest \
  --local \
  --app-name "Internal payments API" \
  --spec-path ./openapi.json \
  --target-host https://payments.internal.example \
  --auth-config ./pentest-auth.json
```

`--image-label` selects the DAST image tag; `--force-pull` refreshes the local image. Use `--use-host-network` only when your Docker platform supports the networking behavior your target requires. Test DNS and target connectivity from the container's network, not just the host shell.

See [Engagement Workflow](/capabilities/pentests/engagement-workflow.md) for authentication and safe handling of the credential file. Local runs require the same authorization and scope review as hosted engagements.

## Hosted private connectivity

PrivateLink configuration APIs are not evidence that hosted scanner traffic is routed through a working private connection. Do not assume creating an endpoint service makes an application reachable by Nullify. Agree and verify any hosted private-connectivity arrangement with your Nullify contact before relying on it; the documented self-managed path is local execution above.

[Exploit Validation](/capabilities/pentests/exploit-validation.md) is a separate hosted workflow. It does not inherit the public CLI's local pentest mode.