The pentest scope doc (PENTEST_SCOPE_2026.md) is the technical brief —
what's testable, what's out, what to focus on. But it doesn't tell
the operator HOW to send the engagement off : credentials delivery
plan, IP allow-list step, kick-off email template, alert-tuning
during the engagement window. So historically each engagement has
been a one-off that depends on whoever was on duty remembering the
last time.
Added :
* docs/PENTEST_SEND_PACKAGE.md — 5-step send sequence (NDA →
credentials → IP allow-list → kick-off email → alert tuning),
reception checklist, and post-engagement housekeeping. Email
template inline so it's grep-able and version-controlled.
* scripts/pentest/seed-test-accounts.sh — provisions the 3 staging
accounts (listener/creator/admin) referenced by §"Authentication
context" of the scope doc. Generates 32-char random passwords,
probes each by login, emits 1Password import JSON to stdout
(passwords NEVER printed to the screen). Refuses to run against
any env that isn't "staging".
The send-package doc references one helper that doesn't exist yet :
* infra/ansible/playbooks/pentest_allowlist_ip.yml — Forgejo IP
allow-list automation. Punted to a follow-up because the manual
SSH path is fine for once-per-engagement use and Ansible
formalisation deserves its own commit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
