Scoping a mobile assessment

A professional assessment starts with written authorization and scope. Define application identifiers, API domains, test accounts, devices and prohibited actions.

• Document in-scope apps and APIs.
• Use dedicated test accounts.
• Agree on data handling and evidence retention.
• Define rate limits and production restrictions.