Security resources
8 things we publish for people working through a penetration test or a platform programme submission. Checklists, real redacted reports, templates and a free scanner. Most are on the page; two are sent as PDFs because we read the request first.
They are written from engagements we ran, which is why the checklist says which items a penetration test does not cover rather than implying it covers everything.
What the Data Protection Policy asks you to produce
The Data Protection Policy sets the evidence a solution provider has to produce, and clause 2.7.2 sets the annual penetration test. These cover what is asked for and what our reports look like.
- SP-API DPP report samples
Network, web application with its API, and cloud, from one real engagement, redacted, with findings mapped to the numbered policy sections.
- SP-API DPP evidence checklist
The eight evidence areas, the clauses each maps to, and which ones a penetration test actually covers for you. Sent as a PDF on request.
- Scope, price and timeline
What we scope against each of the four categories clause 2.7.2 enumerates, and what it costs. Not a resource, the service page, listed here because it answers the next question.
What our deliverables actually look like
Real deliverables rather than a template of one. Redacted, from engagements we ran.
- Penetration test report sample
A full redacted report: findings, evidence, severity reasoning and remediation guidance, in the format a client receives.
- External attack surface report sample
What the free OpenEASD scan returns, so you can judge the output before running one.
Documents to take away and use
Documents to take away and use, whether or not you ever talk to us.
- Pentest report template
The structure a penetration test report should follow, with what belongs in each section.
- Pentest vendor comparison checklist
Twelve sections of questions to put to any testing vendor, so proposals can be compared on the same terms.
See your external attack surface for free
Free and external only. No engagement, no credentials.
- OpenEASD external attack surface scan
Passive, external discovery of what an attacker can already see about your domain. Open source and self-hostable.
Ask for what you actually need
We build these out of engagements we deliver, so the Shopify Partner and Microsoft 365 material is thinner than the Amazon SP-API material for now. If you are working through a programme we have not written up, say so and a founder will answer the specific question rather than send you a document.
Ask a founder