01 / Understand the application
Define the business workflows that matter: a customer opening an invoice, an operator changing an account, or an administrator assigning a role. Record the expected behavior and the assets you have permission to assess.
02 / Agree on scope and policy
Specify allowed hosts, API versions, exclusions, test accounts, time windows, and impact restrictions. Determine who authorizes the assessment and what requires escalation. An agreement should explain how testing is paused or stopped.
03 / Plan and investigate
AI-guided planning is our intended path from application context to relevant test questions. The plan must remain tied to authorized targets and available identities. Coverage should distinguish an attempted test from one blocked by missing access.
04 / Validate and review
Separate an observation from a reviewed finding. Retain the minimum request, response, and role context needed for an analyst to assess the evidence. Uncertain or unreproduced behavior should remain explicitly unresolved.
05 / Report for the next person
A useful handoff states the affected behavior, security impact, relevant evidence, reproduction conditions, limitations, and remediation direction. Remove credentials and unrelated personal information from shared evidence.
06 / Revisit the fix
Record the relevant change and repeat the appropriate check in an agreed environment. Keep the retest conclusion narrower than the evidence: resolved behavior in a scoped check is not proof that the entire application is secure.