Small devices deserve well-defined boundaries.

Map the whole workflow, then narrow the target

A connected device may expose local administration, an app-facing API, and a vendor-cloud connection. Identify each interface and its owner. API review, firmware analysis, radio testing, and physical assessment are different activities. A narrow report should not claim to cover them all.

OWASP's Internet of Things project offers resources for understanding this broader ecosystem. Use the framing to plan the appropriate review rather than assuming that a general web scanner assesses every device layer.

Start with supported configuration

Review update settings, account access, remote features, and documented administration options. Record the actual model and software revision. Remove unused access only through a understood change process, and maintain a recovery path before altering connectivity or authentication.

Do not test essential or safety-related equipment using a generic API checklist. Use supported maintenance procedures and qualified assistance where the consequences require specialist knowledge. A network experiment should not disrupt a household's legitimate access or collect someone else's data.

Raspberry Pi as host or runner

First decide whether the Pi hosts the API or runs the assessment. Check the selected tool's architecture support and resource requirements. When practical, avoid making a small host serve the application and generate its test traffic at the same time. Record resource conditions when interpreting slow responses.

Restrict the runner to approved destinations and protect its reports. A low-cost lab device still needs an operator, maintained software, and a credential policy. See the self-hosted guide.

Smartphones, appliances, and wearable devices

An Android or iOS client may call a server you operate or a vendor service outside your authority. Separate those cases. Reviewing a server-side permission decision does not certify the phone, mobile application, or wearable's storage.

Use synthetic data and an approved test environment. When one is unavailable, limit the work to documentation and configuration review. Keep personal activity, health, location, and account data out of general-purpose reports and AI prompts.

Keep the home-network scope explicit

List exact devices and owners instead of treating a whole local address range as implicitly available. Guest equipment, work laptops, and managed devices may have different rules. Review one deliberate change at a time and confirm ordinary use still works.

The Raspberry Pi and home-network field guide provides a fuller lab example. The platform map helps distinguish an API host, a scanning runner, and an ordinary client.

Primary references

Read the documentation that matches your tool, framework, and deployment. These sources provide context; they do not establish coverage of your environment.

• OWASP Internet of Things