> ## Documentation Index
> Fetch the complete documentation index at: https://how.to.usegolem.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Apps

> Creating, verifying, and managing the apps Golem protects

# Apps

An **App** is the container for everything Golem knows about one target: its domain or store identifier, its assets, its audits, its schedule, and its billing.

## Creating an app

Click **New App** and choose the type:

### Web app

1. Enter a display name and the target domain (e.g. `acme.example.com`)
2. Optionally pick [security focus areas](/audits/overview#security-focus)
3. Click **Create Draft** — the app starts as a draft until ownership is proven

### Mobile app

1. Enter the iOS bundle ID or Android package name (e.g. `com.acme.app`)
2. Golem fetches the app's public store metadata for verification
3. Upload your `.ipa` on the **Assets** page for iOS before scanning
4. Sign the attestation confirming you're the developer or have written permission

See [Mobile Audits](/audits/mobile) for the mobile pipeline.

## Verifying ownership

Verification is required before any audit runs — Golem never audits an unverified target.

**Web apps** — two options, both checked automatically when you click Verify:

| Method   | What to do                                                                          |
| -------- | ----------------------------------------------------------------------------------- |
| Meta tag | Add `<meta name="golem-verify" content="<token>">` to your site's HTML head         |
| DNS TXT  | Add a TXT record at `_golem-verify.<your-domain>` with value `golem-verify=<token>` |

Allow time for DNS propagation if you choose the TXT route. Verification attempts are rate-limited (6 per minute), so give the record a few minutes before retrying.

**Mobile apps** — verified through the store's public developer contact for the identifier, plus the attestation you sign.

On success, Golem immediately kicks off a subdomain scan and a tech-stack scan, and the draft becomes a full App.

## What an app contains

* **Audit history** — every engagement run against the target
* **Findings** — aggregated across all audits
* **Assets** — discovered subdomains with screenshots and stack data
* **Scheduled audits** — cron-based recurring runs
* **Billing** — plan and credit balance (scoped per app)
* **Security focus** — default emphasis areas for deep audits

## Deleting an app

Deleting an app permanently removes its audits, findings, assets, and schedules. Active audits are terminated.

<Warning>
  This cannot be undone. Export any reports you need first.
</Warning>

## Next steps

<Columns cols={2}>
  <Card title="Audits" icon="shield-check" href="/audits/overview">
    Run your first engagement.
  </Card>

  <Card title="Scheduling" icon="calendar" href="/scheduling">
    Set up recurring audits.
  </Card>
</Columns>