PEN testing

#### Description:

Pen testing, or penetration testing, is an authorized, simulated cyberattack on a computer system, network, or application designed to evaluate security weaknesses before malicious hackers can exploit them.

#### Acceptance Criteria:
[Note: Use 'Given/When/Then' format if it makes sense to. Otherwise, a simple checklist that can be tested.]

#### Development Checklist:

- [ ] ...
- [ ] ...
- [ ] ...

#### Dependencies

- Blocked by
- Blocking

**Relevant documentation as reference**

**Definition of Ready**

- [ ] Acceptance criteria are included
- [ ] Wireframes are included (if applicable)
- [ ] Design / Solution is accepted by Product Owner (if applicable)
- [ ] Dependencies are identified (technical, business, regulatory/policy)
- [ ] Story has been estimated (under 13 pts)

**Definition of Done**
- In progress:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] UI meets accessibility requirements
- [ ] Unit tests are written
- [ ] Work is traceable in GitHub
- [ ] PR linked to ticket number
- [ ] If needed/required - Dev adds flag/label to highlight any migration steps necessary prior to PROD deployment
- Code review:
- [ ] Code is peer reviewed and has passed CI/CD tests
- QA:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] Code is potentially shippable to the production environment
- [ ] Functional features have been tested and passed by QA
- [ ] UI components tested by designer
- [ ] Code is deployed to PROD when moved to 'done' column (unless requested otherwise by PO)
- PO Review:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] Reviewed and approved by Product Owner

**Security Validation Checklist**
- Security-focused Peer Review:
- [ ] Reviewer explicitly considers abuse cases, privilege boundaries, and insecure patterns.
- Static Analysis Passed:
- [ ] Security linting tools (e.g., Bandit, ESLint plugins, SonarQube) executed and cleared
- Rate Limiting & Bot Defenses Verified:
- [ ] Anti-automation strategies (e.g., throttling, CAPTCHA/Turnstile, scoring) tested and confirmed.
- Threat Model Completed:
- [ ] Developers have identified potential attack vectors (e.g., spoofing, privilege escalation, data leakage), documented mitigations, and validated that defenses align with system goals and fairness principles.

#### Notes:
-
-

No files, tests, entry points, scope, or actionable acceptance criteria are identified in this issue. Clarify the system and security boundaries to assess, expected findings and deliverables, and completion criteria before work can begin.

Written by the indexing model from the issue text.