Web and API pentesting
Can an account see or do what it should not, or chain small weaknesses into a real path? We use your product the way people do, then the way an attacker would. Authorization, business logic and the small weaknesses that only matter together.
Where accounts do what they should not.
Authentication and sessions
Login, password reset, tokens and sessions that outlive the logout.
- OWASP API2 · A07
Object-level access
Changing an ID in a request to read or edit someone else’s data.
- OWASP API1 · A01
Roles and functions
A regular account reaching the admin actions the interface hides.
- OWASP API5
Business logic
Payments, subscriptions and limits used in an order nobody expected.
- OWASP API6
Exposed APIs
Everything the browser can call, including endpoints the app no longer uses.
- OWASP API9
Chained weaknesses
Small issues that only matter together, followed to a real path.
- Attack paths
Scoped to your app, priced up front.
Every web app and API is different, so we scope it on a call and send a fixed quote in writing before any work begins. No hourly billing.
We need from you: agreed scope, test accounts for each role and one technical contact.
- 01
Manual testing on real paths
On staging, with an account for each role, the way people and attackers actually use your product.
- 02
Findings with reproducible evidence
A request anyone on your team can repeat, mapped to the OWASP Top 10 and API Top 10.
- 03
Priorities by impact and effort
What to fix first and why, talked through live with your team.
- 04
What held up
The tests that passed, so you know what is already solid and not only what failed.
- 05
Review of every fix
A finding closes only when the fix holds.
Evidence, not opinions.
- 01
Understand
Architecture, data flows and trust boundaries, written so your whole team can follow, not only security.
You getA map of the system as it is really used.
- 02
Test
A request anyone on your team can repeat. If it cannot be reproduced, it is not a finding.
You getReproducible evidence for every finding.
- 03
Decide
Findings sorted by impact and effort. Every finding ends in a decision, not in a PDF.
You getWhat to move first, and why.
- 04
Verify
We check every fix. A finding closes only when it is fixed.
You getA review report and controls for the next cycle.
Rules of engagement
Written scope first
Nothing is tested outside what we agreed, and every change is agreed again.
Systems, never people
No one is named in a finding. Team issues are talked through before they circulate.
Your data stays yours
Client data never goes into external AI tools without a signed agreement.
A person signs each finding
AI helps us work, but it never writes a finding or sets a severity.
One field, a paid plan for free.
How a regular account changed the attribute that defined its privileges, and what fixed it.
Is there something you are worried about?
Tell us what you are building and what you need to decide.
What happens next
- 01
You tell us what you are building
Four short questions, or a plain email. No deck needed.
- 02
A person reads it and replies
With an honest first view and the questions we need answered to scope it.
- 03
A 30-minute scoping call
Live or async, as you prefer. We agree on what is in scope and you get the fixed price in writing before any work begins.