exposure-audit
Exposure Audit
Most people running this are not shipping a SaaS with users, a database and file uploads. So most published vulnerability checklists mostly do not apply, and saying "you're fine" after skimming one is useless.
The real exposure is usually a different shape: live credentials in the wrong place, and things that were switched off but are still switched on somewhere. The first audit run with this method found live production API keys sitting in a cloud-synced folder, one of them a payments key for a business that had closed a month earlier. Every app-vulnerability item on the twenty-point list came back clean or not-applicable.
That is the lesson to carry in: scope the surface before running the checklist, or you will spend the whole audit writing N/A next to things the user was never at risk of, and miss the thing that can actually cost them money.