Applications and APIs

Find the flaws scanners miss in your apps.

We test web apps, APIs and mobile clients by hand, source-assisted when available. Each finding is exploited and confirmed before it enters the report.

From login to logic.

Five steps from the first request to the retest.

  1. Map the surface

    Every route, role and tenant goes on the board before the first request.

  2. Break authentication

    Sessions, tokens and authorization are tested across roles and tenants.

  3. Abuse the logic

    We chase the flows a scanner cannot reason about: pricing, workflow, state.

  4. Chain the findings

    Single flaws become attack chains, each link with its reproduction steps.

  5. Prove the fix

    After your fixes land, we re-run every finding and close it with evidence.

What this engagement covers

When you need it

  • Before a major release
  • After a customer security questionnaire
  • For an annual compliance baseline

What we test

  • Authentication, sessions and authorization across roles and tenants
  • Business logic
  • REST, GraphQL and gRPC
  • Mobile storage and transport
  • Third-party dependencies

What you get

  • A report with reproduction steps per finding
  • Attack chains
  • An executive summary
  • A readout
  • A retest of fixed findings

How it runs

  • Duration: Most Assess engagements run two to four weeks from kickoff to readout.
  • What we need from you: A named decision owner, test accounts for each role and tenant, and source where you can share it.

Standards

  • OWASP WSTG
  • OWASP ASVS
  • OWASP MASVS

Frequently Asked Questions

Do you need our source code?
No. We test by hand either way and use source when you can share it. Each finding is exploited and confirmed before it enters the report.
Which API styles do you cover?
REST, GraphQL and gRPC, along with the authentication, sessions and authorization behind them across roles and tenants.
What does the report look like?
Reproduction steps per finding, the attack chains they form and an executive summary, walked through in a readout. Fixed findings are retested.

How We Work

Eight steps from the first call to the closure letter. Every engagement follows them.

  1. Scoping call
  2. Rules of engagement
  3. Threat model
  4. Execution
  5. Analysis
  6. Readout
  7. Remediation support
  8. Retest
Read the full lifecycle

Ready to scope an engagement?

Tell us the asset and the decision the test should inform.

Scope a call