Creating a project
Click New Project from the sidebar Projects panel or the Task/Project selector in the prompt bar.Name the project
Give the project a name that reflects its objective, for example “ClaimFlow Testing” or “Q3 Pentest”.
Add project context (optional)
Describe the scope, goals, and any instructions for Neo. This context is available to every task run inside the project, so you don’t have to repeat it each time. Include things like target URLs, out-of-scope systems, testing constraints, or anything that should persist across the engagement.
Inside a project
A project workspace has five tabs. Tasks is the default view. All tasks run inside the project appear here, with status indicators and the ability to open any task inline without leaving the project. Active tasks auto-expand so running work stays visible. Use the filter to narrow by status. Files holds every file produced across all tasks in the project: scan outputs, payloads, screenshots, reports, and any files you upload. Files are accessible to every task in the project. Issues surfaces all findings generated by tasks in this project, organized by severity (Critical, High, Medium, Low, Info) with status tracking and search. From here you can filter by severity, search across titles and targets, view the source task that produced a finding, and export the full list. See the Issues page for how the issues module works across projects and your entire workspace. Autopilot is where you configure automated and scheduled workflows scoped to this project. Settings is a markdown editor where you define persistent instructions that apply to every task in the project. This is more powerful than the project context field at creation time — it is a structured document Neo reads before every task. Use it to capture:- Test types: what kind of testing to focus on (web app, API, cloud, recon, code review)
- Scope: which hosts, apps, repos, accounts, or roles are in scope, and what to avoid
- Key focus areas: what to prioritize (auth bypass, IDOR, SSRF, business logic, tenant isolation)
- Known context: previously found vulnerabilities, false positives, fragile services, blocked paths
- Reporting preferences: what to include in findings (reproduction steps, evidence, impact, remediation, confidence)

