Technical notes
Tests follow the product
We map roles, permissions, data flows, and important workflows within the agreed scope. We adapt relevant OWASP WSTG tests and use NIST SP 800-115 for assessment planning.
Evidence before a finding
A scanner alert is a lead, not a conclusion. We validate the behaviour with the minimum evidence needed, record the affected asset and preconditions, and give engineers reproducible steps.
Severity needs context
Where appropriate, we include a CVSS 4.0 vector alongside the practical impact. Exposure, data sensitivity, and compensating controls help determine remediation priority; a score alone does not.
Coverage and limits
Findings are point-in-time and scope-bound. We record tested and excluded areas, access constraints, remaining uncertainty, and retest status. An assessment is not a certification or a guarantee that no other vulnerabilities exist.