Web Application Pentesting 1 Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem May 26, 2026