Security test scope (example)
Client:      ____ Logistics (written approval signed by: ____)
In scope:    tracking web app (staging), partner API v2 (staging),
             warehouse portal (test environment)
Out of scope: production databases, third-party carrier systems,
             social engineering of staff
Window:      10-14 Nov 2026, 10:00-18:00
Contacts:    security lead ____, on-call engineer ____
Rules:       no denial-of-service, stop and report critical issues immediately

Asset list to agree before testing
Web apps:     tracking site, seller dashboard, admin portal
APIs:         booking, tracking, label generation, webhooks
Mobile apps:  customer app, delivery partner app
Internal:     warehouse management system, scanners
Cloud:        storage buckets, identity setup
For each: owner, environment, data sensitivity (low / medium / high)

# Flask example: return a shipment only to its owner
from flask import Flask, abort, g

app = Flask(__name__)

def get_shipment(shipment_id):
    ...  # database lookup returning a dict or None

@app.get("/api/shipments/<shipment_id>")
def shipment_detail(shipment_id):
    shipment = get_shipment(shipment_id)
    if shipment is None:
        abort(404)
    if shipment["customer_id"] != g.current_customer_id:   # set by auth middleware
        abort(404)   # do not reveal that the ID exists
    return {"id": shipment["id"], "status": shipment["status"], "eta": shipment["eta"]}

# pytest: confirm one customer cannot read another's shipment (staging/test data)
def test_cannot_read_other_customers_shipment(client, login_as):
    login_as("customer_a")
    resp = client.get("/api/shipments/SHP-B-0001")   # belongs to customer_b
    assert resp.status_code == 404

def test_can_read_own_shipment(client, login_as):
    login_as("customer_a")
    resp = client.get("/api/shipments/SHP-A-0001")
    assert resp.status_code == 200

Finding: Shipment details exposed via ID change (staging)
Severity: High
Affected: GET /api/shipments/{id}
Evidence: Logged in as test customer A, requested SHP-B-0001,
          received customer B's name, phone and address.
Impact: Any logged-in user could view other customers' shipment data.
Recommendation: Verify shipment ownership server-side on every request;
                return 404 for shipments the caller does not own.
Retest: Fixed on 18 Nov 2026 — request now returns 404.

# Nginx: limit each client IP to 10 requests/second on the tracking API
http {
    limit_req_zone $binary_remote_addr zone=tracking:10m rate=10r/s;

    server {
        location /api/shipments/ {
            limit_req zone=tracking burst=20 nodelay;
            proxy_pass http://tracking_backend;
        }
    }
}

Practice project in your own lab
☐ Build a small tracking API with test accounts (Flask or Express)
☐ Deliberately leave out the ownership check in one route
☐ Find it as a tester, write a finding report
☐ Fix it, add an automated test, retest
☐ Add rate limiting and confirm it works
☐ Publish a write-up (no real company names or data)

Before peak season, confirm:
☐ Partner API keys reviewed and unused ones revoked
☐ Rate limits active on public endpoints
☐ Admin portals behind MFA
☐ Lost-device procedure tested for scanners
☐ Backups and restore tested
☐ Open findings from last test closed or accepted

☐ Explain broken object level authorisation with an example
☐ What goes in a scope document
☐ How to write impact for a non-technical manager
☐ Why retesting matters
☐ One finding you discovered in your lab and how you fixed it