Penetration testing · API security testing · OWASP
Penetration testing for SaaS web apps and APIs
A penetration test is an authorised, time-boxed attempt to find security weaknesses in your application before someone else does. I test your web app and API the way an attacker with a customer account would, rate every finding with CVSS, show how to reproduce and fix it, and retest after you fix it.
What I test
- Authorization between tenants and roles (BOLA/IDOR) on every endpoint
- Authentication and sessions: login, password reset, tokens, logout, MFA
- Injection and XSS, file upload, SSRF and path traversal
- Rate limiting and abuse of business logic
- Security headers, TLS, cookies and information leaks
How I work
- Written authorisation, scope and test window agreed before anything starts
- Grey box by default: test accounts for each role, API documentation, no source code needed
- Method based on OWASP WSTG, ASVS Level 2 and the OWASP API Security Top 10
- No denial-of-service and no production data; test tenants only
- Critical findings reported the same day, not at the end
What you get
- A report with CVSS 3.1 ratings, reproduction steps, impact and remediation for each finding
- An executive summary you can share with customers' security reviewers
- A retest of fixed findings with an updated report
- Negative authorization tests added to your regression suite, so fixed issues stay fixed
See what you get
Security
Security and penetration test report
An authorised, scoped test of the web app and API: OWASP-based, CVSS-rated findings with reproduction, fixes and retest status.
94 checks · 105 authorization checks · 9 CVSS-rated findings · Defects · Retest
View Security and penetration test reportDownload PDF of Security and penetration test report
FAQ
Is this a certified pentest for compliance?
It follows OWASP methods and gives you a report you can share with customers. If an auditor requires a specific certification or accredited firm, tell me upfront and we'll check whether this fits.
Do you need our source code?
No. Grey-box testing with test accounts and API docs is the default. Code access helps for specific questions but isn't required.
What about our data?
Testing uses test tenants on staging. Evidence is stored encrypted, shared only with named contacts, and deleted after the final retest.
Need a pentest before a customer's security review? In 15 minutes we'll agree the scope.
Book a 15-min callPrefer writing? Use the contact form. Replies within one business day, from me.