Hi. Indeed we did not write a vulnerability scanner from scratch. We run a few major vulnerability scanners like OpenVAS on the target website, configured in a way to be non-intrusive. We do not communicate on the exact tools that we launch and how we compile the results since this is our secret sauce ...

Fair point about the "GET /article/delete/1" issue, unfortunately a lot of SMB do not have staging/test instances ...