---
id: 4127
title: "Are You Giving Out Cheat Codes if You Whitelist Pen Testers?"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cheat-codes-if-whitelist-pen-testers"
published_at: "2020-07-29T00:00:00Z"
tags: ["waf", "penetration-testing", "methodology", "scoping", "security-controls", "whitelisting"]
phying_url: "https://phying.com/item/4127"
lang: en
---

# Are You Giving Out Cheat Codes if You Whitelist Pen Testers?

## Summary

Brianne Hughes explains why whitelisting pen testers is a scoping decision driven by project goals rather than a cheat code, and when bypassing WAFs better simulates real attackers.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2020-07-29T00:00:00Z
- **Original:** https://bishopfox.com/blog/cheat-codes-if-whitelist-pen-testers
- **Phying News:** https://phying.com/item/4127