If I was to do a web app test on a companies site and I didn't spot something and the company was breached via the app I tested what come back could I possibly have ?

How could I protect myself legally ?

closed as off-topic by RoraΖ, Xander, Jens Erat, schroeder, Mark Feb 19 '15 at 0:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – RoraΖ, Xander, Jens Erat, schroeder, Mark
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    If you were contracted to test it, it depends on the terms of your contract. Whether or not you were contracted, it depends on local law. Read your contract and talk to a lawyer in your jurisdiction; legal advice is off-topic here. – cpast Feb 18 '15 at 20:21

Pentest reports should never give assurance. You can't state that a webapplication is secure, you can only state you didn't find anything or that you did find things. It's important you do not make yourself liable and that your contracts are waterproof as to ensure you do not imply that you guarantee the security of the application.

Not the answer you're looking for? Browse other questions tagged or ask your own question.