So one of the apps I develop and maintain is going to get penetration tested.

I recieved an email if I could whitelist all their ips so they could get acces to the system. Without any further details.

Like wtf? Arent you supposed to be testing if you can get acces xD

Next thing they will be asking passwords and keys xD and if I could build in a backdoor.