Loading this page
Method
The methodology is the set of rules for an engagement: what is in scope, how a finding is judged, and what the report is allowed to claim.
01
Web testing follows OWASP testing guidance. API testing uses the OWASP API Security Top 10 as a checklist, not as a score that implies compliance. Relevant findings can be mapped to OWASP ASVS controls when the reviewer assigns that mapping.
02
Each finding records a severity of critical, high, medium, low, or informational, and the CVSS version used for that finding. The report does not mix versions without saying so.
03
A researcher submits a finding with reproduction steps and evidence. A reviewer can confirm it, reject it, mark it a duplicate or false positive, or ask for more evidence. Customers see published findings.
04
Automated tools can run only after the signed rules are approved and a staff member queues the scan. Their output stays private scanner material. It becomes a customer finding only after review. Burp Suite stays a tool for the person doing the test, not a server dependency.
05
Active testing requires an approved target list and a signed rules of engagement. Out-of-scope hosts are not tested. Redirects off the allowlist are not followed into a test.
06
Tests are rate-limited and avoid destructive actions. Denial of service is out of scope. Credentials are not requested on the public form and are not placed in email or ordinary logs.
07
The report covers the targets, roles, and dates that were agreed. It does not cover code you ship later, accounts you did not provide, or systems you excluded. Time-boxed testing can miss issues.
08
It is not a SOC 2 report, an ISO 27001 certificate, a penetration-test seal, or a promise that an auditor will accept it as the whole of a compliance programme.
Share the application and the reason. We reply in writing. No call is required.