Thanks for that recommendation and advice, I appreciate it. Yeah, I'd definitely prefer to find and propose fixes for exploits over full pentesting (reporting/client work).