Targets and environments
List every web app, API host, mobile backend, and supporting domain. Mark production, staging, and excluded systems explicitly.
Planning guide
Pentest scope checklist
A useful scope describes the attack surface and the business rules worth breaking. It should not be a guess based only on page counts.
What to prepare
User roles and test accounts
Provide at least two accounts per role when horizontal access control matters, plus administrator and unauthenticated paths where applicable.
API surface
Share OpenAPI, GraphQL schemas, Postman collections, authentication flows, webhook definitions, and undocumented legacy endpoints.
Critical workflows
Identify the actions whose abuse would hurt most: payments, exports, invitations, password recovery, approvals, and tenant administration.
Integrations and trust boundaries
Call out identity providers, payment processors, cloud storage, internal services, AI tools, and third-party callbacks.
Safety constraints
Define rate limits, prohibited actions, fragile systems, data-handling rules, maintenance windows, and an emergency contact.
Recent changes and known risks
Flag new authorization models, migrations, major releases, previous findings, and areas that have never received manual testing.
Reporting and retest expectations
Agree on severity scoring, evidence handling, recipient groups, delivery format, walkthroughs, and the remediation retest window.
Example scope worksheet
A small SaaS engagement might start with a worksheet like this. Replace every row with an explicit decision.
| Area | Example | Decision |
|---|---|---|
| Application | Customer portal and admin console | Include |
| API | api.example.com REST + GraphQL | Include |
| Roles | Customer, manager, support, administrator | Include |
| Environment | Dedicated staging with production-like data model | Include |
| Third parties | Payment provider hosted checkout | Boundary only |
| Prohibited | Denial of service and destructive data deletion | Exclude |
Scoping questions
What determines the cost of a web application pentest?
The main drivers are the number of applications and endpoints, user roles, workflow complexity, integrations, environment constraints, and required reporting or retesting. A precise scope is more useful than a generic page-count estimate.
How many test accounts should we prepare?
Prepare at least two accounts for every role where users should be isolated from one another. Two accounts let testers verify horizontal authorization failures instead of testing only role changes.
Should production be included in scope?
Use a production-like staging environment when it faithfully represents authentication, authorization, integrations, and data flows. Production testing can be appropriate when those conditions cannot be reproduced, but it needs explicit safety rules and escalation contacts.
Do we need an OpenAPI specification?
It is not mandatory, but accurate API documentation improves coverage and reduces time spent rediscovering endpoints. Provide schemas, collections, example requests, and authentication instructions if available.
Turn the worksheet into a test plan
Send the target list, roles, and critical workflows. We will identify missing scope details before proposing an engagement.
Request scope review