What we test
Scope follows the OWASP API Security Top 10 (2023). The work that finds the most, and is skipped most often, is authenticated testing across roles and tenants. It is the only way to find broken object- and function-level authorisation. We ask for your OpenAPI/Swagger spec so we can cover nearly every route (a missing spec is a finding in itself).
- Broken Object Level Authorization (BOLA / IDOR) across tenants and roles
- Broken Function Level Authorization (BFLA) via role and method swaps
- Broken Object Property Level Authorization: mass assignment and excessive data exposure
- Authentication, unrestricted resource consumption and sensitive business flows
- Injection, SSRF and security misconfiguration
- GraphQL specifics: introspection, batching, nested-query DoS and error disclosure
Grey-box, authenticated, multi-role
Grey-box is the cost-effective norm: you supply the spec and test accounts for each role. The testing is manual-first, because scanners catch misconfiguration and known CVEs but miss the authorisation and business-logic flaws behind most API risk.
- 1
Scoping & accounts
We agree boundaries and collect multiple accounts across roles and tenants, plus your OpenAPI/Swagger spec.
- 2
Endpoint inventory
We map every route and operation from the spec and live traffic, and flag any gaps in the spec.
- 3
Authentication & authorisation probing
We test object- and function-level access control across roles and tenants, where most API risk sits.
- 4
Input, injection & business-logic abuse
We test injection, SSRF, resource consumption and abuse of sensitive business flows with proof of concept.
- 5
Reporting & free re-test
You get a prioritised report with request/response evidence; we re-test fixed issues at no extra charge, within the window set in the Statement of Work.
What you receive
The same depth as our sample report, whose worked finding happens to be a cross-tenant IDOR in an API (CWE-639, CVSS 3.1). Every finding comes with the evidence needed to reproduce and fix it.
- Executive summary and overall risk posture
- Each finding: description, impact, evidence, steps to reproduce and remediation
- Proof of concept as request/response pairs
- Severity scored with CVSS 3.1 and translated into business risk
- References to the OWASP API Security Top 10 (2023) and CWE
- Free re-test of remediated issues, within the window set in the SoW
Grounded in the OWASP API Security standards
Coverage maps to the OWASP API Security Top 10 (2023); GraphQL testing also follows OWASP WSTG-APIT-01 (Testing GraphQL). Authorisation findings (BOLA, BFLA, object-property) need several accounts across roles and tenants, because a single token cannot reveal them. Findings are scored with CVSS 3.1.