Creating a project
Click New Project from the sidebar Projects panel or the Task/Project selector in the prompt bar.1
Name the project
Give the project a name that reflects its objective, for example “ClaimFlow Testing” or “Q3 Pentest”.
2
Add project context (optional)
Describe the scope, goals, and any instructions for Neo. This context is available to every task run inside the project, so you don’t have to repeat it each time. Include things like target URLs, out-of-scope systems, testing constraints, or anything that should persist across the engagement.
3
Set visibility
Choose who can access the project:
- Everyone in team — all current and future workspace members have access
- Invite only — only you and the members you explicitly invite have access
Inside a project
A project workspace has five tabs. Tasks is the default view. All tasks run inside the project appear here, with status indicators and the ability to open any task inline without leaving the project. Active tasks auto-expand so running work stays visible. Use the filter to narrow by status. Files holds every file produced across all tasks in the project: scan outputs, payloads, screenshots, reports, and any files you upload. Files are accessible to every task in the project. Issues surfaces all findings generated by tasks in this project, organized by severity (Critical, High, Medium, Low, Info) with status tracking and search. From here you can filter by severity, search across titles and targets, view the source task that produced a finding, and export the full list. See the Issues page for how the issues module works across projects and your entire workspace. Autopilot is where you configure project autopilot: a project-level automation that creates a new task on a schedule, pulling all accumulated task history and project settings so Neo can continue making progress automatically. Settings is a markdown editor where you define persistent instructions that apply to every task in the project. This is more powerful than the project context field at creation time — it is a structured document Neo reads before every task. Use it to capture:- Test types: what kind of testing to focus on (web app, API, cloud, recon, code review)
- Scope: which hosts, apps, repos, accounts, or roles are in scope, and what to avoid
- Key focus areas: what to prioritize (auth bypass, IDOR, SSRF, business logic, tenant isolation)
- Known context: previously found vulnerabilities, false positives, fragile services, blocked paths
- Reporting preferences: what to include in findings (reproduction steps, evidence, impact, remediation, confidence)
Running tasks inside a project
The task input inside a project works the same as the main prompt bar, with the workflow templates (Pentest, Vuln triage, Code audit) available as quick-start shortcuts. Every task you run inherits the project context automatically. Task cards in the project view show the task status and expandable working memory — todos, facts, insights, and tracked files — so you can see what each task knows without opening it.Managing members
Click Invite in the project header to add teammates. You can add individual workspace members by searching for them, or toggle Share with entire team to give everyone in your workspace access automatically. The person who creates the project is the owner. Only the owner can manage membership, update project settings, and delete the project. All other members can create tasks, view project data, and access files and issues.Project autopilot
Project autopilot creates a single dedicated automation for an entire project. When it runs, Neo reads all previous task results and project settings, then determines what to do next. Each run creates a new task in the project and is recorded in the Execution History panel on the Autopilot tab. Autopilot is different from task automations. A task automation runs a specific prompt you write, on a schedule you set, for a repeatable job. Autopilot uses a fixed, system-generated prompt and draws on everything the project already knows to decide what to work on.How it works
When autopilot runs, Neo pulls all task context from the project, including completed tasks, working memory (facts, insights, todos, and tracked files), and the project settings. It then creates a new task using the accumulated project context. Every task completed inside the project, including those created by previous autopilot runs, becomes part of the context for the next run. The more work that has been done in the project, the more informed each subsequent run becomes. Autopilot adds one new task per run. It does not automate, re-run, or take over the tasks already in the project, and enabling it does not change how the tasks you start yourself behave. The autopilot prompt is fixed and cannot be customized. Every run starts from the same standing instruction, which is to continue making progress on the project from its latest context. Nothing new is written or generated for each run, and there is no prompt field to fill in or edit. What changes between runs is the context wrapped around that instruction: the project settings as they read at run time, and everything the project has accumulated since the last run. That is why two runs of the same autopilot behave differently while the instruction stays identical. If you need to control exactly what runs on a schedule, use a task automation instead.Steering autopilot
Because there is no prompt to write, project Settings is where you steer autopilot. The scope, objectives, focus areas, known findings, and constraints you record there are read before every run, so they do the job the prompt would otherwise do. Autopilot is most useful on a project that already has history behind it. Run a few tasks yourself, fill in Settings, then enable it, so the first automated run has real context to build on instead of starting from an empty project.Enabling autopilot
Open the Autopilot tab inside a project and configure the schedule.1
Set the frequency
Choose Daily, Weekly, Monthly, or Custom. Custom lets you select the specific days of the week autopilot runs, which is how you keep runs on working days only.
2
Set the run time
Pick the hour and minute the run starts. Run times are set in UTC, in fifteen minute increments.
3
Choose a reporting mode
Changes only reports on a run when it finds something new compared with the previous run. Full report returns a complete report of every run regardless of what changed.
Managing an active autopilot
The Autopilot tab shows the current schedule, the next run time, and the total number of runs, along with these controls:- Run Now starts a run immediately without waiting for the next scheduled time and without changing the schedule
- Pause and Resume stop and restart scheduled runs, keeping the configuration and run history intact
- Edit changes the frequency, run time, or reporting mode of an existing schedule
Execution history
Each autopilot run appears under Execution History on the Autopilot tab, with the run time, status, and a short identifier. Runs show as pending, running, completed, or failed, with the run duration and any error message alongside. Click any entry to open the task that ran.Opening and steering a run
An autopilot run is not a black box. Each run creates an ordinary task in the project, so it opens in the normal task view with the full plan, logs, insights, issues, files, and network activity for that run. You can reach it from Execution History, or from the project’s Tasks tab, where autopilot runs sit alongside the tasks you started yourself. Because these are ordinary tasks, they stay open after they finish. You can ask a follow-up question inside a completed autopilot run, push it further on something it found, or chain into a new task from where it stopped, exactly as you would with any task you started. That is also the fastest way to course correct. A follow-up you write inside an autopilot run belongs to that task, and completed tasks feed the context of later runs, so a correction you make there carries forward. Use project Settings for direction that should apply to every future run, and a follow-up inside a run for something specific to what that run just did.Autopilot vs. task automation
Both features run Neo tasks automatically, but they serve different purposes.
Use task automation when you have a specific, repeatable job to run on a schedule: a daily DAST scan, weekly recon sweep, or recurring API audit. You write the prompt and control what happens each time.
Use project autopilot when the entire project is your unit of work and you want Neo to pick up where it left off. This is most effective when all tasks in the project share a common goal and the accumulated context makes each new run more informed than the last.
For example: if your project goal is to test a web application, autopilot will use everything Neo has already discovered (endpoints, findings, completed scans, settings) to decide what to investigate next. It does not re-run prior tasks; it creates new ones.
Common use cases
Daily DAST scan — Create a task automation with your DAST prompt and set it to run daily. This gives you a fixed, repeatable scan with a prompt you control. Do not use autopilot for this. Ongoing security research project — Set up a project scoped to a target, add context in Settings (scope, objectives, known findings), run a few initial tasks, then enable autopilot. Neo will continue the research on a schedule, building on each previous run. Continuous penetration testing — Use autopilot on a project configured for a specific application. As Neo completes tasks and files findings, future autopilot runs incorporate that history and shift focus to unexplored areas.Limitations
- One autopilot per project. A project supports a single autopilot configuration; you cannot run multiple concurrently.
- No prompt customization. The autopilot prompt is fixed. Use task automation if you need a specific prompt.
- Project scope only. Autopilot is not available outside of a project.
- Recurring schedules only. Autopilot cannot be set to run once at a future time; use a one time task automation for that.
- Run times are UTC. The schedule does not follow your local time zone or adjust for daylight saving changes.