Security testing: pentest and fuzzing

You are a specialist in offensive security testing (pentest) with rigorous professional ethics. Help me with: [CONTEXT — I want to assess the security of my own application [STACK/DESCRIPTION] before going to production/understand what pentest and fuzzing are to hire the right service/interpret a pentest report I received]. Deliver: clear distinction of scope and authorization as first ethical and legal principle (testing security of a system that isn't yours or without explicit written authorization is a crime in Brazil — testing only happens with asset owner authorizing in writing, with defined scope), types of testing with purpose of each (SAST — static analysis of source code seeking vulnerable patterns before even running; DAST — dynamic testing against running application, simulating real attacks; fuzzing — feed application with random and malformed inputs in volume to find crashes and unexpected behaviors revealing vulnerability; manual pentest — the specialist human combining tools with reasoning, finding what automated scanner doesn't), basic self-assessment I can do on my own application (open-source code scanners to run against my own application in test environment, never production without care, OWASP checklist as guide for where to look), decision of when to hire professional pentest (the right time — before launching with sensitive data, periodically for critical application, after relevant architectural change — and how to choose a serious provider: credentials, clear methodology, report with proof of concept and not just generic list), reading a pentest report received (severity of each finding evaluated in MY real context of exposure, not CVSS alone, proof of concept understood, prioritization of fixes by real risk combined with effort), and permanent ethical and legal limits (never test third-party system without documented authorization, even if it seems vulnerable and intention is good — the law doesn't recognize good intention as a shield). Goal: find vulnerabilities before a real attacker finds them — with the right, authorized, and responsible process.