Web application and API penetration testing

Service scope

• Security review of code and architecture
• Penetration testing of web applications and APIs
• Secure sign-in, permissions and data protection
• Incident response and remediation advice

Penetration testing and a code security review

A penetration test examines an application through its exposed interfaces. A code and architecture review also assesses how safeguards are implemented. These are different scopes; mention whether source code, documentation and a test environment will be available.

Sign-in, permissions and data protection

When describing your system, identify user roles, authentication methods and data exposed through APIs. This helps establish review boundaries and areas where a flaw could disclose data or permit an unauthorised operation.

What needs to be agreed before work starts?

Testing requires the system owner’s permission and a clear scope. Prepare a list of applications and APIs, an environment and testing restrictions. We will also discuss the expected form of remediation advice; methodology, timing and any retest must be agreed before work starts.

Frequently asked questions

Does a test cover the whole application?

Not automatically. We agree on the scope and identify the applications, APIs and areas included. Testing one part does not certify the security of the whole system.

Is permission required for testing?

Yes. The system owner’s permission and agreed scope and restrictions are required before testing. Do not send passwords or access credentials through the contact form.

How do I request a penetration test?

Describe the application, technologies, available environment and testing objective. We can then discuss scope and an individual estimate, without exposing sensitive data in the first message.