Endpoint / API Pentest

Authorized, safe-by-default HTTP/API testing. Read ../../SECURITY_RULES.md first. Conservative rates; owned/staging targets; read-only unless a write is explicitly authorized against a disposable record.

Deliverables

• Route inventory
• Endpoint Risk Matrix (../../templates/endpoint-risk-matrix.md)
• Confirmed / Suspected Findings, Passed Checks
• Fix plan + regression tests