What is a penetration test?
The test enterprise customers ask to see a report from. Here is what it proves, and what it does not.
Reviewed by Irfan Habib, Co-founder (engineering)
In short
A penetration test is an authorized, simulated attack on an application or system in which security testers try to exploit weaknesses the way a real attacker would, then report what they reached. Unlike an automated scan, it proves which weaknesses can actually be used.
Also called: Pen test, Pentest
How does a penetration test work?
NIST's glossary collects several definitions that agree on the core: assessors, typically working under specific constraints, attempt to circumvent or defeat the security features of a system, mimicking real-world attacks. The constraints matter: a test is agreed in writing beforehand.
That agreement sets which systems are in scope, which accounts the testers get, and when they may test. The result is a report of what they could reach and how.
NIST SP 800-115 is the US government's guide to planning such tests, analysing the findings and developing mitigations. For web apps, many testers work from the OWASP Web Security Testing Guide, whose current stable release is version 4.2.
When is a penetration test worth paying for?
A penetration test is most useful once the obvious gaps are closed. Run against an AI-built app nobody has reviewed, it mostly finds what a code audit would have found more cheaply: tables without row-level security, keys in the browser, endpoints that trust the client. Fix those first, then pay testers to find what is left.
What should a good pen test cover?
A good pen test covers access control between users and customer accounts, authentication from sign-in to tokens, injection and input handling, exposed secrets, misconfiguration and outdated dependencies, and business logic, such as whether someone can get something without paying. These areas line up with the OWASP Top 10.
- Access control between users and between customer accounts.
- Authentication: sign-in, password reset, sessions, tokens.
- Injection and input handling.
- Exposed secrets, misconfiguration and outdated dependencies.
- Business logic: can someone get something without paying for it?
These line up with the OWASP Top 10, the most widely used list of web application risks, whose 2025 edition puts broken access control first.
What does a pen test look like for a Lovable or Supabase app?
In a Lovable app on Supabase, the browser talks to the database directly with a public key, so the most valuable test is simple: sign in as one user and try to read or change another user's rows, then repeat as a signed-out visitor.
Testers also look for the service role key in the shipped JavaScript, and for edge functions that accept a user ID from the client instead of reading it from the session.
What are the common mistakes with penetration tests?
Three mistakes waste most pen test budgets: testing too early and paying people to find what a scan or review would have found, a scope that leaves out the API or the admin screens, and filing the report without fixing and re-testing the findings, which enterprise buyers often ask to see evidence of.
- Testing too early, and paying people to find what a scan or review would have found.
- A scope that leaves out the API or the admin screens.
- Filing the report without fixing and re-testing the findings. The report is also a sales document: enterprise buyers often ask for a recent one, and for evidence the findings were fixed.
If you want the cheap gaps closed before testers arrive, start with the production readiness check or our vibe coding rescue.
Common questions
What is the difference between a penetration test and a vulnerability scan?
A scan is automated and lists known weaknesses. A penetration test is done by people, who try to exploit weaknesses and chain them together to show real impact. That is why a pen test is most useful once the obvious gaps are closed; a scan cannot replace one.
How often should we have one?
Commonly once a year and after major changes, or whenever a customer or auditor requires it. Enterprise buyers often ask for a recent report and for evidence that the findings were fixed. Run the first once the obvious gaps are closed, so the testers spend time on harder problems.
What methodology do penetration testers follow?
There is no single mandatory one. NIST SP 800-115 is a widely used guide to planning tests, analysing findings and developing mitigations, and for web applications many testers work from the OWASP Web Security Testing Guide, currently version 4.2. Ask any tester which one they follow.
Can I pen test an app built with Lovable myself?
You can do the basic checks: sign in as two different users and try to read each other's data, then try again signed out, and search the shipped JavaScript for secret keys. That catches the most common gaps. An independent test is still what enterprise buyers will ask for.
Go deeper
Lovable app security checklist: is your app secure?A checklist for RLS, keys, payments and monitoring, with a way to verify each item, and what CVE-2025-48757 means for you.
Related terms
Read next
Sources
- NIST glossary: penetration testing
- OWASP Top 10:2025
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment
- OWASP Web Security Testing Guide
Sources checked October 24, 2026
More on this: Production architecture & security · All glossary terms
Built something in Lovable you want people to rely on?
We are the engineers who take it the rest of the way — secured, tested, released and supported.
