Seeded test discussion. How would you validate building an authorized asset inventory in an authorized engagement?
Scenario: Enumerate approved domains, subdomains, APIs, and public services from owner-provided records and passive sources. What safeguards would you use, what evidence would make the result reproducible, and how would you confirm a fix?
Related guide: https://pentest.vanillatesting.com/kb/articles/11-building-an-authorized-asset-inventory