Australian-owned · Northern Rivers NSW · Authorised testing only
Web application & API security testing
Manual testing of your web applications and APIs against OWASP guidance, focused on the authentication, access-control and business-logic flaws that automated scanners miss.
What we cover
Authenticated application testing
Every role you give us, including how one user could reach another user's data or functions.
API testing
REST and GraphQL APIs: authorisation on every object and function, input handling, rate limiting and data exposure.
Business logic
Workflow abuse, payment and approval bypasses, and other flaws specific to how your application works.
Pre-launch assurance
Testing before a release or launch, with developer-ready findings your team can fix quickly.
What you receive
- Findings mapped to OWASP categories
- Proof and risk rating for each finding
- Developer-ready remediation steps
- A retest of fixed findings
How an engagement works
- 1Scoping call
A confidential conversation about your environment, goals, constraints and timing. You get a tailored quote with a defined scope.
- 2Signed authorisation
Nothing is tested until your authorised representative signs the rules of engagement, naming every in-scope target, the techniques allowed and anything excluded.
- 3Authorised testing
Testing stays inside the signed scope. Out-of-scope addresses are refused by the platform itself, and every action is recorded in a tamper-evident log.
- 4Reviewed findings
Each finding is risk-rated with evidence and practical remediation steps, and reviewed before it is released to you.
- 5Fix and retest
We help your team prioritise, then retest fixed findings so you have evidence for auditors, insurers and clients.
Common questions
Do you test in production?
We prefer a production-like test environment. Production testing is possible when you authorise it and we agree safe limits.
Do you need source code?
No, but access to documentation, API specifications or test accounts makes testing deeper and more efficient.