A clear process.
At every boundary.
Manual website testing built around an agreed target, controlled validation, practical reporting, and honest limits. AI-built websites, PHP applications, APIs, and custom stacks all need those boundaries.
- 01
Define the engagement
Confirm ownership, exact targets, allowed accounts and roles, timing, exclusions, emergency contact, and stop procedure. Agree delivery, fees, and crypto invoice terms before testing.
Output: a written scope and engagement agreement. - 02
Map the agreed application
Understand selected features, entry points, authentication, role boundaries, and data flows. Access level and time determine the depth; coverage is recorded rather than implied.
Output: a record of the assessed areas and relevant limits. - 03
Investigate and validate
Review relevant paths for XSS, SQL injection, command injection, RCE, file handling, access control, and other in-scope weaknesses. Separate suspected issues from validated findings. Use proportionate proof with dummy accounts and minimal data where possible.
Output: reproducible evidence and a clear impact explanation. - 04
Report privately
Explain the issue, prerequisites, affected area, severity rationale, evidence, and remediation. Redact unnecessary personal information and secrets. State untested areas and assessment limits.
Output: a useful report your developers can act on. - 05
Check the fix
Where retesting is agreed, revisit the original weakness and relevant allowed and denied paths. Record the tested version, retest evidence, result, and remaining limits. A submitted fix becomes “passed” only after validation.
Output: a documented retest outcome.
References for planning and reporting
Relevant checks are selected for each scope. These references support the approach; this page makes no certification, endorsement, or complete-coverage claim.
OWASP Web Security Testing Guide ↗NIST SP 800-115: testing and assessment guidance ↗