Tested the way your users could abuse it.
Manual testing of your web applications and APIs, signed in as each of your roles, following the OWASP Web Security Testing Guide and the OWASP API Security Top 10. Scanners find the obvious. The serious findings usually sit in access control and business logic.
- Price
- Set in your written proposal
- You receive
- An executive summary, ranked findings with evidence and fixes, and a retest.
Scope, timeline and price in writing before any work starts.
What we test. Every layer of the application.
- 01
Authentication and sessions
Login, password reset, multi-factor authentication, single sign-on and session handling.
- 02
Access control
Whether one user can see or change another user’s data, and whether one tenant can reach another.
- 03
Injection and input handling
SQL and NoSQL injection, cross-site scripting, template injection and unsafe file uploads.
- 04
Business logic
Prices, limits, workflows and race conditions: the abuse a scanner cannot see because it does not understand your product.
- 05
APIs
REST and GraphQL endpoints, including the ones your front end never calls, mass assignment and object-level authorization.
- 06
Configuration
Security headers, TLS, CORS, error handling and secrets exposed in client code.
Questions, answered.
01Do you test signed in?
Yes, as each role you give us. Most serious findings are only reachable after login.
02Can you test production?
We prefer a staging environment with realistic data. If production is the only option, we agree time windows and exclude destructive tests in writing.
03Do you cover the OWASP Top 10?
Yes, and more. The Top 10 is a list of risk categories, not a test plan, so we follow the full OWASP testing guides.
Know where you stand before an attacker does.
Tell us what you want tested. We will come back with a scope, a timeline and a price.