Scope, test types and limitations
A.1 Types of penetration test
A penetration test can be run with more or less information about the target:
| Type | What it is | What it requires |
|---|---|---|
| Black box | The tester starts from the public address only, like an external attacker. Everything is discovered from the outside. | The URL only. |
| Gray box | The tester is given partial access: a test user, API documentation, an architecture description. | URL + limited credentials or information. |
| White box | The tester has the source code and/or administrative access. Enables static code analysis (SAST) and dependency analysis (SCA), with far broader coverage. | Source code + access. |
The product tiers map as follows:
- Essencial — black box: OSINT and non-invasive testing.
- Completo — black box + invasive application phases (SQL Injection, XSS, IDOR) and compliance checks.
- Avançado — the above + white box: SAST and SCA over the source code the client provides.
A.2 The two layers of a web system
- Application layer — what the client built: screens, business logic, authentication, permissions, API calls, database configuration. This is the layer the system owner controls and can authorize for testing.
- Infrastructure layer — the servers, network and the hosting platform itself that host the application. When the target runs on a managed hosting platform (for example Lovable, Vercel, Netlify, Supabase, Firebase, WordPress.com, GitHub Pages, Cloudflare Pages), that layer belongs to the platform provider and is shared across its customers. The platform provider is responsible for that layer; the client is responsible for the application layer. This audit focuses on the application layer — the logic, authentication, permissions and configuration under the client's control.
A.3 What we test and what we do not
| We test (application layer) | We do not test (platform infrastructure) |
|---|---|
| Security headers and HTTPS/TLS configuration | WAF / platform firewall evasion techniques |
| CORS, cookies, secrets exposed in browser code | Denial of service (DoS), stress, SlowLoris |
| Authentication and authorization flaws | Real high-volume password brute forcing |
| IDOR — changing an identifier to reach another user's data | Webshell / malicious file upload |
| SQL Injection, XSS, CSRF | High-noise automated scanners (Nuclei, OWASP ZAP) — outside self-service |
| Business logic (skipping steps, tampering with price or quantity) | Social engineering, phishing, physical access |
| Rate limiting (is there an attempt cap?) | Source code analysis (SAST/SCA) — Avançado tier only |
| LGPD compliance in how the application handles data | Any destructive test |
| Passive reconnaissance: DNS, WHOIS, certificates, technologies | — |
A.4 Targets on managed platforms
When the technical verification indicates the target runs on a managed hosting platform, the active scope is the same application layer scope as for any other target — no phase is dropped because of the platform. Destructive testing (intentional downtime, DoS, stress, SlowLoris, real high-volume credential brute forcing, malicious/webshell upload) is never run, on any tier, against any target. What a managed platform changes is the context: the infrastructure (network, server, edge WAF) belongs to the platform and is shared across its customers, so infrastructure-layer findings are outside what the client controls and can authorize. The final report names the detected platform to make the hosting context clear and lists the phases left out only because they are not part of the purchased tier.
A.5 General limitations
- Point-in-time snapshot. The report reflects the target's state on the test date. Later code or configuration changes are not covered.
- Absence of findings is not a guarantee. Not finding a vulnerability does not certify that none exists.
- Black box does not see the code (except in the Avançado tier). Flaws visible only in the code — internal logic, outdated dependencies, backend secrets — may go undetected.
- Production testing can be masked. There is no separate staging environment; the platform's WAF and rate limits may block or distort part of the testing, producing results marked inconclusive.