Scoping a Web App Pentest So Nothing Gets Missed

[SEED CONTENT — replace] This article is placeholder copy seeded to exercise the layout. Swap it for a real write-up before launch.

Most pentest disasters don't happen during exploitation — they happen during scoping, three weeks before the engagement starts. A vague statement of work turns into a client asking why you tested a staging environment they didn't know was in scope, or worse, why you didn't.

Get the asset inventory in writing

Domains, subdomains, IP ranges, mobile builds, and API hosts all belong in the scoping document — not in a Slack message the client sent once. If an asset isn't listed, treat it as out of scope, full stop, even if it looks trivially in-scope from the outside.

Define authentication boundaries explicitly

• Which roles get test accounts, and at which privilege tiers?
• Is testing authenticated-to-authenticated privilege escalation in scope, or only unauthenticated-to-authenticated?
• Are third-party SSO providers (Okta, Auth0) part of the target, or is auth itself off-limits?

Rules of engagement that prevent 2 a.m. phone calls

A short, explicit RoE section avoids almost every mid-engagement dispute:

- Testing window: Mon–Fri, 09:00–18:00 local time
- No automated scanning against payment endpoints
- DoS/stress testing: explicitly excluded
- Emergency contact: security-oncall@client.example (response SLA: 30 min)

Confirm the reporting format before day one

Ask what the client actually does with the report. A compliance-driven client wants CVSS scores mapped to a framework. An engineering-led client wants reproduction steps and a fix PR-ready description. Scoping the output, not just the target, is what makes a report land instead of getting filed away unread.

Good scoping isn't paperwork — it's the difference between a report the client acts on and one that becomes shelfware.