Security testing
Hands-on tests. Proof you can reproduce.
All security testingHow we workWhat happens after the first call.See the processBuild
We break software for a living. This is what we build.
All build servicesProof of workOur own apps, built the same way.See themHands-on testing of your web app and the APIs behind it, mapped to OWASP WSTG, ASVS and the API Security Top 10.
If one customer can see another customer’s data, we’ll find the route that lets them.
Out of scope stays out. We ask first.
Login, MFA, password reset, and how tokens are issued, stored and revoked.
Every role, object and tenant, on every route that reads or changes data.
Workflows, limits, payments and state changes no scanner can reason about.
Injection, templates, file uploads and the parsers behind them.
REST and GraphQL, object-level authorisation, mass assignment, rate limits and error leaks.
Headers, CORS, CSP, caching, and secrets in front-end bundles.
Targets, roles, test accounts, environments and dates. Then a fixed written quote.
A crawl of the app and a read of the API schema: endpoints, roles, data flows.
Scanners and Semgrep clear the common classes, so our hours go to the hard parts.
WSTG and the API Top 10 by hand, mostly access control and business logic.
A small, safe proof of concept for each issue.
A walkthrough with your engineers, then a free retest of the fixes.
How a finding reads
| Findings mapped to |
|
|---|---|
| Tools we use |
|
Grey box by default: test accounts for each role, plus your API docs. White box adds a code review with Semgrep and CodeQL. Black box shows exactly what an outsider sees.
Scope decides it: roles, endpoints and workflows. We estimate on the scoping call, and the quote fixes the dates.
Staging that mirrors production, so we can push risky paths without touching real data. If it has to be production, limits and hours go in writing, and you can pause us at any time.
Test accounts for each role, API docs or an OpenAPI or Postman file, a technical contact, and written authorisation from whoever owns the system.
Send the scope and your deadline, and we’ll set up a call.
