Web Application Penetration Test.

External application surface against the OWASP Top 10 and the application's documented role boundaries.

Session, authentication, and authorization paths reachable without source access.

Misconfiguration of the application server, reverse proxy, and TLS where in scope.

Application URL, account-creation flow or per-role credentials, and a brief role description.

Authorization to test before any traffic is sent.

A stakeholder contact for emergency stop and account-lockout recovery.

Pre-engagement intake, mutual NDA, and the legal-instrument set apply identically to gray-box engagements.

Active testing runs against the agreed environment without source-assisted context.

Findings are validated manually before any severity is assigned.

Report is reviewed against a defensibility checklist before delivery.

Executive summary, per-finding write-ups, and an evidence pack at the same standard as gray-box engagements.

Explicit note in the executive summary that testing was performed without source-assisted access.

We will not say the application is secure.

We will not represent black-box coverage as gray-box coverage.