Web security · applications and APIs

Penetration testing for your web application

We find the vulnerabilities before someone else does: we verify them manually, prove them with evidence and tell you exactly how to fix them.

OWASP Top 10 and ASVSBlack-box or grayboxRetest after remediation
Request a quote →How we work
What we test

An attacker’s whole path through the application

Not just what a scanner finds, but also what a person who thinks like an adversary sees.

Injections and input handling

SQL injection, XSS, command injection, file uploads, SSRF and insecure deserialisation — the OWASP Top 10 classes, checked on every entry point.

Authentication and sessions

Password policy, lockout after attempts, password reset, 2FA, session lifetime and invalidation, cookies, CSRF and JWT tokens.

Authorisation and access between roles

Can one customer see another’s invoices? Can a regular user perform an administrator action? IDOR and privilege escalation, checked role by role.

REST and GraphQL APIs

Each API is tested as a target in its own right: authentication, rate limits, excessive data exposure and object-level access, following the OWASP API Security Top 10.

Business logic

Prices changed in the cart, skipped payment steps, discounts applied twice — flaws no scanner understands, because it does not know what the application is supposed to do.

Configuration and exposure

Security headers, TLS, CORS, exposed files and panels, vulnerable component versions and error messages that say too much.

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
What should we test?
How many user roles does the application have?
How large is the application?
Do you have API documentation or source code you can share?
How do we test?
On which environment?
When may we test?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How a pentest unfolds

Following the OWASP Web Security Testing Guide, PTES and OSSTMM — and after a signed testing authorization, before any test.

  1. Scope and quote

    You tell us which applications, APIs and roles are in scope; you receive a quote with the scope, duration and schedule.

  2. Testing authorization

    You sign the authorization in the portal: the targets, the testing window and the rules. No test starts without it.

  3. Reconnaissance and testing

    We map the application, then manually test each vulnerability class, with automated tools only as support. You see the testing status in the portal.

  4. Report and walkthrough

    You receive the executive and technical reports; serious findings are flagged to you immediately, not at the end.

  5. Remediation and retest

    Once you fix them, you request the retest from the portal: we verify each finding and close it with evidence.

What you receive

Deliverables

  • Executive report: the risk in terms management understands, without jargon
  • Technical report: every finding with severity, evidence and reproduction steps
  • Concrete remediation steps, for your technology
  • Findings in the portal: owner, due date, history and one-click retest
  • An attestation letter for auditors, publicly verifiable
Further reading

Guides related to this service

OWASP Top 10 guideHow to prepare for a pentestPentest or vulnerability scan?
FAQ

What clients ask us

How long does a web application pentest take?
Usually 3–5 days of testing for a web application, followed by the report. The exact duration depends on the number of roles, APIs and the size of the application; we fix it in the quote once we see the scope.
Do you test the application behind the login?
Yes. In a graybox test we receive test accounts for each role (for example user and administrator) and check whether one role can reach another role’s data or actions — that is usually where the most serious issues are.
Is there any risk to the application in production?
We work with maximum caution: tests are scheduled with you, after a signed testing authorization, and any action that could delete or change data is agreed in advance or performed on a test environment.
What do we receive at the end?
An executive report for management and a technical one for the team: every finding with its severity (critical, high, medium, low), the evidence and the remediation steps. You also track the findings in the portal, where you request the retest once they are fixed.
What else is in the portal besides the report?
A read-only public API with company keys (findings as JSON, CSV or SARIF) and an MCP server for AI assistants; remediation analytics with mean time to remediate and, when there is enough data, a comparison with the platform median; passive attack surface discovery that starts only from your company’s own domains; the engagement calendar as an .ics file or a subscription; a one-way Slack or Teams channel per engagement; and several companies under one account, with a switcher between them.

Want to know where your application stands?

Describe the scope; we reply with a quote within one business day.

Request a quote →