Authorisation and role checks
Whether another user's record or another role's screen can be reached.
Security review
We hunt for authorisation, session and input-validation weaknesses on the OWASP Top 10 baseline.
This does not replace a penetration test; it targets the common and expensive mistakes in the application layer. Authorisation bypass, horizontal and vertical privilege escalation, session handling, insecure direct object references and input validation are the main focus.
From the checklist
38 check items
Session and token lifecycle
Whether sign-out, a password change and expiry really end the session.
Input validation and injection
Server-side validation, file upload and query escaping.
Sensitive data exposure
Fields that should not appear in responses, logs or error pages.
How we run it
- We map the role matrix: what each role should and should not be able to see.
- We push the permission boundaries of every role by hand — horizontal and vertical escalation attempts.
- We test the session lifecycle: sign-out, password change, expiry and concurrent sessions.
- Input validation, file upload and response bodies get both an automated scan and a manual review.
What you get
- A finding list mapped onto the OWASP Top 10 categories
- Request and response capture plus reproduction steps for every finding
- The role-permission matrix and the deviations we found
Out of scope
- This is not a penetration test; infrastructure, network and social engineering are out of scope.
- Source code security review and dependency scanning are separate engagements.
What this typically turns up
- Sessions on other devices survive a password change
- Changing the order number exposes another customer's invoice
- The API returns an identity field the interface never shows
Questions about this service
Does this replace a penetration test?
No. It targets the common and expensive mistakes in the application layer. If regulation requires a pen test report, we will point you to an accredited firm.
Do you need the source code?
Not required — we can work black box. With code access the results improve noticeably, especially on permission checks.
Do you exploit what you find?
Only far enough to prove it exists. We do not exfiltrate data, do not leave changes behind, and log every attempt.
Included in
ReleaseWhole product, 3 platforms, pre-launchFleetRegression every release, monthlyEnterpriseRegulated sectors, custom SLA
Other services
Functional testingDo the critical flows work end to endRegression testingDid the new release break the old oneCompatibility matrixReal device and browser matrixPerformance & loadLoad speed and behaviour under loadAPI testingSchema, error codes and boundariesPayment testingPayments, refunds and subscriptions with real cardsAccessibilityWCAG 2.2 AA and screen readersUsability reviewFlows that work but wear people downLocalization testingCountry by country, with native speakers
Don't test the next release alongside your users.
Sign up in the panel, pick what you want tested, pay. The first findings start landing in the same panel within hours.