What we do.
- Map the agreed application routes, user roles, and associated APIs.
- Investigate authentication, permissions, input handling, and relevant business workflows.
- Use manual testing and automated checks to validate identified weaknesses within the authorized scope.