> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kikimora.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Web applications overview

> Web application entries define the targets, crawl scope, and authentication that Kikimora's Qualys-backed scanners need before any web scan can run.

The **Web Applications** module is the management hub for web application targets in Kikimora's Qualys-backed scanning infrastructure. A web application entry defines the target boundaries, entry points, crawling scope, and authentication a scanner needs before it can run.

## Web application vs. target URL

A **web application** is a logical entity representing an entire web asset. It holds the metadata: risk ownership, asset tags, crawling parameters, and associated authentication records.

A **target URL** — also called the start URL — is the single `http://` or `https://` endpoint the scanner begins crawling from. One is the asset; the other is the door the scanner walks through.

## Authentication records

Authentication records store the credentials scanners use to reach protected areas of an application, such as a standard username and password pair. You can select an existing record or create one inline while setting up a web application.

## How scans attach

Web applications are mandatory scan targets. The application must exist in Kikimora before a scan can be scheduled or launched against it, and any results and vulnerabilities the scan produces associate back to that web application automatically.

## Related modules

* [Scans](/scans/index) — defines the scan jobs and schedules that target these applications.
* [Auth records](/auth-records/index) — manages reusable application login credentials.
* [Vulnerabilities](/vulnerabilities/index) — aggregates the findings discovered across your web applications.