Web Application Pentesting 1 Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem May 25, 2026