Our hackbots
- Map every route, parameter and API version
- Run the full permission matrix: every role against every route
- Fuzz inputs, uploads and parsers at a pace no person can match
Web application penetration testing
Small flaws add up to a breach.
Access control, account takeover, customer isolation and business logic in the product your users sign in to.
Scope and deliverables
What we look at
- Every role against every endpoint, sideways and upward
- Login, reset, invites, MFA and sessions
- Whether one customer can read or change another’s data
- Payments, quotas and workflow abuse
What you get
A report with a CVSS 3.1 vector per issue, requests your engineers can replay, and fixes.
Typical length
2 to 3 weeks for a SaaS product
Methods aligned with
OWASP ASVS, CVSS 3.1
Why it matters
Breaches in modern products come from logic, and logic needs a person who understands your product. A scanner tests one request at a time. It does not know that a member should never see another customer’s invoices.
We test every role against every endpoint, sideways and upward, and combine small issues into the attack path a real intruder would follow.
One chain, four small flaws
Scanners and AI-only tools report each issue on its own and rate it low. A researcher asks what they add up to.
- 01
Source map lists a legacy admin route
The public bundle ships a source map that names an old admin invite route.
- 02
The old v1 API is still deployed
v2 replaced it months ago, but v1 still answers on the same host.
- 03
v1 invite skips the role check
Any member can send invites, not just admins.
- 04
Invite trusts the organization ID from the request
So a free-trial account can invite itself as admin into any customer’s workspace.
Four issues a scanner would file as noise. Together, one critical path, proved end to end.
How we test it
Hackbots for breadth. Hackers for depth. Every lead is proven or discarded by a researcher before it reaches your report.
Our researchers
- Find business-logic flaws in payments, quotas and workflows
- Test login, reset, invites, MFA, SSO and sessions for account takeover
- Prove impact with a request you can replay, then write the fix
How an engagement runs
Five steps from the first call to the retest. You work directly with the researchers testing your systems at every one of them.
Scope
1 to 3 daysWe agree on assets, test accounts and rules of engagement, then send a fixed price.
Recon
First days of testingHackbots map every host, route and role. A researcher builds the threat model.
Exploit
Most of the windowHackbots run the matrix at scale while researchers test by hand and take each lead to the end.
Report and fix
Within 5 working daysVerified issues only, each with a CVSS 3.1 vector, replayable proof and a patch.
Retest
Free, within 90 daysWe confirm each fix and issue an updated report and attestation letter.
Related services
API and cloud penetration testing
The APIs behind your apps and the cloud accounts they run in, tested from outside and with a normal customer’s access.
AI app launch review
A fixed-scope review for apps built with AI app builders and coding assistants, before you launch, raise or sign your first big customer.
Continuous penetration testing
For teams that ship every week, often with AI assistants: agents test each release and a researcher reviews what changed.
Tell us what you run. We’ll send a fixed quote.
No obligation and no sales sequence. A senior researcher reads every request and replies within one working day.