I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid since the underlying code could change drastically between testing and general availability. The development organization's view is they have fixed some vulnerabilities in the upcoming release and want to verify that is true and determine if any new vulnerabilities have been introduced.
- Are there any standards or guidelines for what constitutes a valid penetration test?
- Are there any best practices or guidances around pentesting alpha/beta level software that hasn't hit GA?
NOTE: I'm looking for guidelines on what makes a pen test valid or what actions invalidate it.