Browser workflows and server-side trust
Test sessions, roles, business logic, input handling, files, administrative actions, and the integrations reached through the application.
Explore web application pentesting
Pentest services
Web application and API security testing scoped to your decision.
Start with a focused web and API assessment. Add adjacent surfaces only when they affect the release, customer request, or assurance outcome.
Choose the product boundary
Dedicated web application, API, or combined testing.
Use the focused pages to inspect exact coverage and prerequisites. Use the combined sprint when browser journeys and supporting APIs share the same trust model.
REST, GraphQL, webhooks, and service identities
Test object, function, and property authorization, tenant isolation, resource controls, data exposure, and sensitive business flows.
Explore API pentestingOne product boundary across web and API
Trace controlled identities from the browser through API calls, tenant transitions, integrations, evidence, remediation, and re-test.
Review the combined sprintChoose by outcome
One core offer. Three practical engagement shapes.
The exact scope and quote follow a short scoping call. These shapes make the likely fit clear before you invest time in procurement.
Release Check
A constrained assessment of one high-risk feature or workflow before launch.
- One defined workflow or feature
- Limited roles and integrations
- Targeted web and API coverage
- Technical findings report
- One bounded re-test
Web & API Pentest Sprint
End-to-end testing of one customer-facing application and its supporting APIs.
- Multiple relevant user roles
- Authentication and tenant isolation
- Business logic and abuse cases
- Executive + technical report
- Critical alerts, walkthrough, and re-test
Release Assurance
A recurring review for meaningful product changes after a baseline assessment.
- Change-based scope each cycle
- Regression of high-risk controls
- New roles, APIs, and integrations
- Updated finding register
- Clear per-cycle authorization
Scope before price
What changes the effort, timeline, and quote.
A credible fixed quote needs more than a URL. These are the inputs that materially change testing effort.
| Scope input | Lower-complexity shape | Higher-complexity shape | Why it matters |
|---|---|---|---|
| Applications & APIs | One app, one API | Multiple apps, gateways, or versions | More routes, trust boundaries, and data flows |
| Roles & tenants | User and admin | Several roles, partner access, multi-tenant hierarchy | Authorization testing grows with role and tenant combinations |
| Authentication | Local email/password | SSO, MFA, passwordless, OAuth integrations | Each identity flow adds states and abuse cases |
| Business workflows | Standard CRUD flows | Payments, approvals, credits, invitations, exports | Business logic needs scenario-led manual testing |
| Environment & readiness | Stable staging, docs, test data ready | Production-only, sparse docs, changing release | Safety controls and discovery time increase |
| Reporting need | Engineering remediation | Customer, board, or framework mapping | Evidence and review requirements differ |
Core coverage
Test the trust boundaries scanners cannot reason about.
Coverage is adapted to the architecture and threat model; it is not a generic checklist run against every product. See how approved AI assistance widens hypotheses while human validation remains mandatory.
Identity & session
Registration, login, recovery, MFA, SSO/OAuth, token lifecycle, session invalidation, and account enumeration.
Authorization & tenancy
Object and function access, role escalation, tenant boundaries, administrative actions, invitations, and ownership changes.
Business logic
Workflow bypass, replay, sequence abuse, quota and credit manipulation, race conditions, and integration trust.
Input & execution
Injection, request forgery, unsafe file handling, browser-side execution, deserialization, and server-side processing flaws.
API-specific controls
Object, property, and function authorization; resource consumption; inventory; data exposure; and unsafe downstream trust.
Configuration & exposure
Security headers, CORS, caching, error behavior, exposed interfaces, dependencies, and relevant deployment weaknesses.
Adjacent surfaces
Add coverage where application risk crosses the boundary.
These are scoped as extensions or separate engagements after confirming they are relevant and safely testable.
Mobile application testing
Android or iOS client behavior, local storage, transport, platform controls, API trust, and tamper-related risks.
Discuss mobile scopeCloud configuration review
Scoped IAM, storage, network exposure, secrets paths, and service configuration that affect the application.
Discuss cloud scopeExternal attack surface
Authorized internet-facing assets, exposed services, administrative interfaces, and exploitable configuration paths.
Discuss external scopeIncluded by default
Part of the flagship sprint
- Scoping call and written statement of work
- NDA and rules of engagement
- Manual validation of actionable findings
- Urgent escalation for agreed severity threshold
- Executive and technical reporting
- Remediation walkthrough
- One bounded re-test in the agreed window
Explicitly controlled
Separate approval or scope
- Production load, stress, or denial-of-service testing
- Social engineering or physical testing
- Third-party assets without written authorization
- Source-code review unless stated
- New features introduced after the test window
- Compliance certification or guaranteed audit acceptance
- Additional re-test cycles beyond the agreement
Scoping FAQ
Make the boundaries explicit.
A focused scope review turns these variables into written assumptions and a defensible proposal.
Can you test production?
Yes, when production testing is authorized and appropriate. The rules of engagement must define safe techniques, rate limits, test data, customer-data handling, monitoring, escalation contacts, and stop conditions. A representative staging environment is preferred for riskier scenarios.
Can you work from a customer’s security questionnaire?
Yes. Share the exact request and deadline during scoping. We will distinguish what the pentest can evidence from what remains an organizational, governance, or compliance responsibility.
Do you provide a clean letter after remediation?
The re-test update records each finding as fixed, partially fixed, not fixed, or not re-tested. A concise closure letter can summarize the agreed outcome without claiming that the entire system is vulnerability-free.
Can we start before procurement is complete?
No testing begins without an executed agreement, written authorization, finalized scope, and rules of engagement. Scoping and document review can happen while procurement progresses.
What if a critical issue appears during testing?
We use the agreed escalation channel immediately rather than waiting for the final report. Testing pauses if the rules or safety conditions require it.
Get a defensible quote
Bring the app, roles, integrations, deadline, and reason for testing.
Receive clear boundaries, assumptions, and next steps before testing begins. No testing or additional work starts until it is authorized and agreed.