security testing notes