It’s both sane and welcome. the alternative to unsolicited testing is your app getting owned and your customer data being sold and you being sued into oblivion. unsolicited. Your vulnerability doesn’t cease to exist because you don’t want people to look at it.