PlexTrac Pentest Reporting vs timing_attack (2026)