Find the way in before someone else does.
Authorised, hands-on testing that proves what an attacker could do.
- CriticalAdmin API reachable without a sessionAPI · /admin/█████
- HighPassword reset token does not expireAuth · reset flow
- HighSecret key committed to repositoryRepo · config/█████.ts
- MediumNo rate limit on sign-up and OTPAPI · /auth/████
- LowMissing security headersWeb · all pages
Illustration of our report format. Details are invented and redacted.
Full
$6,000Prices in USD. Pay in your local currency at checkout.
Web app, API and admin areas.
- Web app + API
- Up to 5 user roles
- Business logic testing
- Payment and money-flow abuse checks
- Debrief call
- One re-test
NDA on request · Authorised testing only · Reports shared only with you
Our engineers attempt to break into your web app, API or mobile app within an agreed scope, chaining weaknesses together to show real impact. Every finding comes with evidence, a risk rating and clear steps to fix it.
Testing only happens with signed authorisation from the system owner, inside agreed windows, and never includes denial-of-service or social engineering unless you request it in writing.
iOS or Android app added to scope
A signed summary for partners and investors
We help your developers fix each finding (estimate; confirmed after the report)
- 01Written authorisation from the owner of every system in scope
- 02The URLs, apps, servers or repositories in scope (and anything out of scope)
- 03A technical contact we can reach during testing
- 04Test accounts for each user role, if the system has logins
- 05A staging environment if possible (we can test production with care)
Yes, when the system owner authorises it in writing. We will not test anything without signed authorisation and an agreed scope.
Staging is best. If we test production, we agree safe windows and avoid anything that could affect your customers.
Not by default. These need separate written approval and planning.