Technical guides, methodology and lessons from real web application, API and mobile assessments. The blog of Veritus Code, a penetration testing consultancy for SMBs and startups.https://blog.verituscode.com/enhttps://blog.verituscode.com/en/blog/security-requirements-bank-payment-integration/https://blog.verituscode.com/en/blog/security-requirements-bank-payment-integration/Questionnaires, a recent pentest, PCI DSS and evidence: what banks, payment processors and enterprise clients usually require from a fintech, and how to prepare without slowing the business down.Sun, 08 Nov 2026 00:00:00 GMTfintechpci-dsscompliancepentestingstartupshttps://blog.verituscode.com/en/blog/fintech-api-vulnerabilities/https://blog.verituscode.com/en/blog/fintech-api-vulnerabilities/IDOR on transfers, mass assignment of balances, race conditions, unlimited OTP attempts and forgotten versions: what they are, how to test them and how to fix them.Sun, 25 Oct 2026 00:00:00 GMTapifintechowasppentestingbolahttps://blog.verituscode.com/en/blog/what-are-cves/https://blog.verituscode.com/en/blog/what-are-cves/CVE, CWE, CVSS, EPSS, KEV… We explain in plain terms what each acronym means, how a vulnerability is scored, and how to decide which ones to fix first.Sun, 11 Oct 2026 00:00:00 GMTcvecvssvulnerabilitiesnvdrisk-managementhttps://blog.verituscode.com/en/blog/web-pentesting-methodology/https://blog.verituscode.com/en/blog/web-pentesting-methodology/How we assess a web application end to end: scope, reconnaissance, mapping, analysis, controlled exploitation and a report the client actually understands.Wed, 30 Sep 2026 00:00:00 GMTpentestingmethodologyowaspreconburp-suite