Services

Web application penetration testing

Authenticated and unauthenticated testing of the application itself, including business logic, access control between roles, and the paths a real attacker would chain together.

Roles, session handling, access control, business logic, input handling, file upload, and the client side.

API security testing

REST and GraphQL surfaces tested directly rather than through the interface, because the interface is not what enforces the rules.

Authorisation per endpoint, object level access control, rate limiting, schema abuse, and mass assignment.

External perimeter testing

What is reachable from the internet, what it exposes, and what it reveals about everything behind it.

Exposed hosts and services, TLS configuration, email authentication records, and forgotten infrastructure.

Cloud configuration review

Configuration reviewed against how the application actually uses it, since most cloud findings are permissions that were never narrowed after launch.

Identity and access policy, storage and database rules, serverless function permissions, and logging coverage.

Other scopes are available on request. Tell me what you have and I will tell you whether I am the right person for it.