What appears before invasive testing
Plenty of exposure does not require intrusion. It appears in DNS, forgotten routes, old pages, published files, metadata, and error messages. For a small SaaS, this is often more useful than hunting rare issues.
What to review first
- Domains, redirects, and old subdomains.
- Public files, maps, backups, and forgotten routes.
- Error messages with service names or internal paths.
- Headers exposing unnecessary technology or incorrect cache.
- Documents with names, directories, or versions.
RET starts with visible points because fast-built SaaS often leaves clues there. The goal is to reduce exposure before opening a larger scope.
