How to Prepare Your Web App or API for a Penetration Test

Define why the assessment is happening#

Is the goal a product release, customer due diligence, risk reduction or verification of specific functionality? This determines priorities and depth.

Supply representative access#

Prepare dedicated test identities for normal users, organization admins, privileged functions and separate tenants if the application is multi-tenant. Avoid sharing personal employee accounts.

Stabilize the environment#

Choose a staging environment that mirrors production security decisions or agree on production-safe constraints. Note external integrations and features that cannot be safely exercised.

Document the attack surface#

Provide base URLs, API specifications or collections, login flows, role descriptions, relevant mobile builds and expected business behavior. Unmaintained documentation should be identified as such.

Agree on escalation and exclusions#

Set authorized targets, testing dates, emergency contacts, prohibited activity and data-handling expectations. Initial enquiry is not authorization to test.

Plan for remediation#

Reserve engineering time after delivery. A report without ownership of fixes has limited value. Include an agreed retest window where possible.