Do you do Magento penetration testing?

Yes. Our audit includes Magento penetration testing built on the OWASP methodology, we actively probe the storefront, admin and REST/GraphQL APIs for injection, broken authentication, access-control flaws and misconfigurations, not just run an automated scanner. Testing is scoped and authorised in writing first (rules of engagement), and runs against staging where possible to avoid disrupting live traffic.