Would writing API security tests for a website that one works for require written permission from superiors? The tests simply check if all endpoints return 401. (assuming permission was obtained, but not written)
Or ensure no timing attacks are possible on specific endpoints. They contain **no params/body**.
if you boss knows about it, and allowed you to, send him an email or message saying "according to our talk, I will be doing this and that" and that's it
and if he says "no", don't go ahead
it's easy to say "I never say that" when nothing is written down... an email is written down, with exact what you will do
