So this is what pen-testers need to know when getting paid to pen-test foo. Do not trust anything that claims security because of being "extensively pen-tested".