03
Before launching an app: when and what to test
Launching an application or a customer portal is a good moment for a pentest: fixing a flaw before you have users is simpler than fixing it with real data inside.
When to do it
When the features are settled and before real users arrive. Test too early and what you tested will change; test the day before launch and there will be no time to fix anything.
Leave room for fixing and for the retest. Dates are agreed together with the scope.
What to test
Many serious flaws in a new application are invisible to a scanner, because they live in the logic: a user who can see or change someone else's data, a role that does what it should not, or a step in a process that can be skipped.
That is why the test uses one user per role and also covers the API behind it, not just the interface. If the application launches on a new domain, it is worth including what is exposed to the internet around it.
What to prepare
An environment identical to production. If there is an equivalent pre-production environment, better to work there; if not, what may be touched in production, and when, is agreed.
One test user per role, with test data and not real customer data.
Written authorisation from the owner of the systems. If the application runs on a cloud or hosting provider, check its terms for security testing too.
After launch
A test holds for what was there that day. If the application changes a lot (new roles, payments, integrations), the part that changes deserves another test.
And once the report's flaws are fixed, the retest checks that the fixes hold.