Web applications & APIs
We test authentication, permissions and business workflows across the application and its APIs.
What we examine
Identity & sessions
Login, password recovery, session handling and changes to account access.
Roles & tenant isolation
Horizontal and vertical access control across organisations, users and sensitive objects.
APIs & business logic
Authorisation, workflow abuse, input handling and interactions between services.
Data exposure
Uploads, exports, sensitive responses and paths to unintended disclosure.
When this adds value
We use accounts with different roles and organisations to test billing, integrations and other workflows. This shows how access changes between users and where permissions fail.
Information needed for a quote
Application and API URLs, a feature list, user roles, tenant structure, authentication flows and API documentation. Provide accounts for each relevant role and tell us about webhooks, file processing, payments and third-party dependencies.
Evidence included
The account and role, the request or workflow, the expected access decision and what actually happened. Where safe and agreed, we demonstrate impact using synthetic records. Coverage and untested features are stated explicitly.
Scope, test, report.
Then verify the fixes.
Scoping, testing, reporting and verification, with direct access to the tester.
Agree the scope.
Applications, roles, access and deadlines. We agree the scope, fee and deliverables before testing.
Run the assessment.
Test the controls and the workflows around them. Significant findings are communicated during the engagement.
Document the findings.
Reproducible findings, demonstrated impact and practical recommendations for your developers.
Verify remediation.
Discuss remediation and validate agreed fixes. Retesting terms are set out in the proposal.