Since 2009, mgm Hybris / SAP Customer Experience is operating sucessfully and is considered a competent partner for building complex e-commerce systems. As a result of constantly handling the security aspects of those projects in the last years, we are aware of the essentials when it comes to examining a Hybris / SAP Customer Experience solution. The test cases of the standard Web Application Security Pentests are extended by aspects specific to a Hybris environment. In addition to that, adjusted to the environment, specific proposals for action are given.