> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Penetration testing

> Third-party penetration testing cadence, scope, and results.

<Warning>
  **Status — April 2026**: A third-party penetration test has **not yet been commissioned**. Target: engage a CREST-accredited or equivalent firm by **Q3 2026** and publish a sanitized executive summary on this page.

  Until then, our defensive posture relies on automated SAST, dependency scanning, and Terraform config scanning on every commit — see [Vulnerability management](/trust/vulnerability-management).
</Warning>

## Planned scope

When our first engagement commences, the scope will cover:

<CardGroup cols={2}>
  <Card title="External application pentest" icon="globe">
    Black-box testing of the production web application and public API endpoints, focused on the OWASP Top 10.
  </Card>

  <Card title="Authentication testing" icon="fingerprint">
    Login, 2FA, passkeys, OAuth, magic links, session handling, account enumeration, timing attacks.
  </Card>

  <Card title="Authorization testing" icon="lock">
    IDOR, broken object-level authorization, privilege escalation, tenancy isolation.
  </Card>

  <Card title="Infrastructure review" icon="server">
    Terraform review, network segmentation, IAM bindings, Workload Identity Federation configuration, CMEK and Secret Manager access.
  </Card>
</CardGroup>

## Cadence (planned)

| Activity                           | Cadence                                |
| ---------------------------------- | -------------------------------------- |
| External pentest                   | Annually                               |
| Remediation validation retest      | 30 days after each pentest             |
| Internal red-team exercise         | Annually (post first-pentest)          |
| Ad-hoc pentest after major changes | Within 30 days of architecture changes |

## What we'll publish

* **Executive summary** (on this page) — scope, methodology, high-level findings count by severity.
* **Remediation status** — every high/critical tracked here until closed.
* **Detailed report** (under NDA) available to customers on request.

## Our defensive testing today (without a pentest)

We don't consider automated tooling a substitute for adversarial testing, but it's what we run in the interim:

* Brakeman SAST — every commit, blocking merge on medium+ severity.
* bundler-audit + npm audit — every CI run.
* Trivy config scan — every Terraform change.
* ESLint security plugins and `no-unsafe-*` rules — every PR.
* gitleaks — every commit.
* License compliance scanning — every PR.
* Test coverage requirements — 90% backend, 80% frontend.
* Global Pundit authorization enforcement — 48 policy files.
* Cloud Armor WAF (OWASP CRS v3.3) — at the edge in production.

*See [Vulnerability management](/trust/vulnerability-management) and [Change management](/trust/change-management).*