Applications / APIs

Application Security Review

Hands-on review of the application paths that can produce unauthorized access, data exposure, account compromise, or workflow abuse.

Discuss your applicationExplore the review
Application review
RolesMemberAdministrator
The access boundaryWho can see
and change what?
IdentityPermissionData
Expected behaviour, checked.
↗Useful findings.
Evidence → impact → fix
Follow access from the application to its data.

Built around your system

Products with user roles, sensitive records, APIs, or high-value workflows.

How we work together

What gets tested

Protect customer data and the actions that matter.

The review compares what different users can see and change, follows state transitions, modifies identifiers and hidden properties, and verifies whether the server enforces the intended rule. Reconnaissance supports discovery; impact is reproduced manually.

Areas we investigate

  1. 01

    Authentication, sessions, password reset, MFA, and account recovery

  2. 02

    Object- and function-level authorization, tenant isolation, and administrative boundaries

  3. 03

    REST, GraphQL, and mobile-backed APIs across meaningful user roles

  4. 04

    Stored and reflected XSS, file uploads, SSRF, CORS, injection, and sensitive data exposure

  5. 05

    Business workflows where smaller weaknesses combine into a practical attack path

What to bring to the first conversation
  • Authorized target list and environment
  • Test accounts for meaningful roles
  • Relevant documentation and production safeguards
  • Timeline, communication path, and exclusions
Full preparation guide

What you leave with

A clear result.
A practical next step.

Prioritized findings with clear impact, reproducible evidence, and guidance your developers can use to fix the issue.

See a sample finding
Engagement deliverables
  1. 01Concise executive summary
  2. 02Technical findings with prerequisites and reproduction steps
  3. 03Request/response evidence where appropriate
  4. 04Impact and severity rationale
  5. 05Practical remediation guidance
Prepared for your team. Reviewed by Garrett.

The work, in brief

  1. 01

    Map the application

    Routes, roles, and high-value actions.

  2. 02

    Exercise the boundary

    Inputs and authorization paths under review.

  3. 03

    Record the proof

    Reproducible impact with remediation direction.

Further reading

See the thinking behind the work.

Published research and practical guidance for this review.

Applications / APIs

Discuss your application.

Security testing

Share the system, your main concern, and your timeline. I’ll help define a useful scope and explain what the engagement would include.

Discuss a security reviewExplore website services