Penetration testing

Service

Tested by hand.
Web and mobile.

Security engineers test your web app, your iOS and Android apps, and the APIs behind them the way an attacker would. You get a report your developers can work from, then a retest that shows the fixes hold.

Request a scoping callSee what we test
SIGNED IN AS USER A GET /v2/accounts/8813/statements Authorization: Bearer eyJ…a91 HTTP/1.1 200 OK { "owner": "User B", "iban": "GB29 •••• 4471", "balance": 18240.55 } Swapped my ID for theirs. Still 200. Anyone's statements. Critical. NANDEE PENTESTER · DAY 2 RETEST FIXED GET …/accounts/8813 403 GET …/accounts/8812 200

What we test

The app, the API,
and the gap between them.

Web apps, native iOS and Android, React Native, and Flutter. Checks follow the OWASP Top 10 for web and the OWASP MASVS for mobile, and we go past the checklist wherever your app does something unusual.

  • Web and mobile · Authorization

    Can user A see user B?

    Every API call the app makes, replayed with other IDs, other roles, and no token at all.

  • Web and mobile · Sessions

    Does logout log you out?

    Token lifetime, refresh, revocation, password reset, MFA, and biometric unlock.

  • Web and mobile · Business logic

    What a scanner can't guess

    Negative amounts, skipped steps, reused coupons, and races on anything that moves money or data.

  • Web · Injection

    Where input becomes code

    SQL and NoSQL injection, XSS, SSRF, template injection, and file uploads.

  • Web · Browser controls

    What the browser is told to trust

    Cookies, CSRF, CORS, Content Security Policy, clickjacking, and open redirects.

  • Web · Configuration

    What was left switched on

    Exposed admin panels, debug endpoints, verbose errors, and public storage buckets.

  • Mobile · Data on the device

    What stays behind

    Keychain and Keystore, files, caches, logs, screenshots, and backups.

  • Mobile · Entry points

    Every door into the app

    Deep links, intents, URL schemes, WebViews, and anything exported to other apps.

  • Mobile · Reverse engineering

    What the binary gives away

    Secrets, hidden endpoints, and security checks that only run on the client.

How an engagement runs

Five steps.
No surprises.

  1. 1

    Scope

    A call to agree on apps, platforms, APIs, user roles, and what's off limits.

  2. 2

    Kickoff

    You share builds or URLs, test accounts, and a contact. We confirm the testing window in writing.

  3. 3

    Test

    Hands-on testing, for as long as the scope needs. Critical issues reach you the day we confirm them, not at the end.

  4. 4

    Report

    Every finding with steps to reproduce and a fix, walked through on a call with your team.

  5. 5

    Retest

    Once you've shipped fixes, we test each finding again and update the report.

The report

Written for the person who fixes it.

Short where it can be, specific where it counts. No pages of scanner output.

  • Summary for leadershipWhat we tested, what we found, and what it means, on one page.
  • Findings your developers can reproduceSeverity, exact requests, steps, and evidence for each one.
  • A fix for every findingSpecific to your platform and framework, not a link to a wiki.
  • Retest results and a letter you can shareScope, dates, and what's been fixed, for customers and auditors who ask.
FINDING 03 OF 11Critical

Any signed-in user can read any account's statements

Reproduce
  1. Sign in as user A and open Statements.
  2. Change the account ID in the request to user B's.
  3. The API returns user B's statements with a 200.
GET /v2/accounts/8813/statements
HTTP/1.1 200 OK
Fix

Check that the account belongs to the signed-in user on the server, before reading it. Don't trust the ID the app sends.

Retest · fixed · now returns 403

When teams book one

Before a big release

A new payments flow, a new login, or a rewrite that touches everything.

When a customer asks

Security questionnaires and enterprise deals that want a recent third-party test.

For an audit

Evidence for PCI DSS, SOC 2, or HIPAA work. We support the audit; your auditor certifies.

Once a year

A fresh pair of eyes on an app that has changed since the last test.

Pricing

Priced per engagement, quoted up front.

After the scoping call you get a fixed quote and a start date. The retest is included.

What shapes the quote

  • Apps and platformsWeb, iOS, Android
  • API surfaceEndpoints in scope
  • User rolesCustomer, admin, partner
  • Sensitive flowsPayments, health data

Fair questions.

How long does it take?

It depends on the scope. We agree the testing window on the scoping call and confirm it in writing.

Who does the testing?

Senior penetration testing engineers, working under the supervision of a manager.

Do you test in production?

It depends on the scope. We suggest testing your production environment as well.

Do you test React Native and Flutter apps?

Yes, along with native iOS and Android.

Will you sign a BAA?

Yes. We sign BAAs for healthcare apps.

Let someone try. On your terms.

Request a scoping call