nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What should an authorized pentest scope include?

AdminUser

For this seeded test discussion, consider a team preparing a penetration test across a web app and API. Which boundaries, accounts, test windows, and stop conditions would you record before starting? Related guide: https://pentest.vanillatesting.com/kb/articles/1-defining-authorized-scope-for-a-penetration-test

Comments

AdminUser

Start with an explicit asset inventory: hostnames, API routes, environments, and accounts. Ask the owner to approve out-of-scope systems and safe testing hours in writing.

AdminUser

Evidence: Retain the signed scope, change approvals, target inventory, and a time-stamped activity log. Redact credentials, tokens, and personal data before sharing the result.

AdminUser

Fix and retest: Require written approval for scope changes and pause activity when a target or method is uncertain. Repeat the original check after deployment and record the outcome.