Object & function level authorisation
BOLA and BFLA across every documented and undocumented endpoint. Identifiers are swapped, incremented, guessed and replayed between accounts and tenants.
API & GraphQL security testing
APIs fail differently from web apps. There is no UI to constrain what you send, so the interesting bugs live in what the server is willing to accept — objects that belong to someone else, fields you were never meant to set, and queries expensive enough to become an outage.
Scope
What we actually test
Tested against your specification and against reality — the two are rarely the same.
Mass assignment
Extra fields injected into request bodies to set attributes the client was never meant to control — roles, entitlements, tenant identifiers, pricing and internal flags.
GraphQL specifics
Introspection exposure, deeply nested and recursive queries, alias-based rate-limit bypass, batching abuse, field-level authorisation gaps and error-message disclosure.
Authentication & tokens
JWT algorithm confusion and signature verification, token lifetime and revocation, API key scoping and leakage, OAuth scope enforcement and refresh-token handling.
Rate limiting & quotas
Whether limits exist, whether they are enforced per-tenant or globally, and whether they can be bypassed through casing, encoding, header spoofing or alternate routes.
Undocumented surface
Deprecated versions, internal endpoints reachable from outside, debug routes and the API version you forgot was still deployed.
Every engagement ships with
- Executive summary written for leadership
- Technical report with reproducible proof-of-concept for every finding
- CVSS v3.1 vectors and a plain-English business-impact narrative
- Prioritised, concrete remediation guidance
- Same-day alerting on anything critical
- Live debrief with your engineering team
- Free retest of every finding within 90 days
- Signed attestation letter for auditors and customers
FAQ
Questions about this service
Do you need our OpenAPI or GraphQL schema?
It helps and speeds things up, but it is not required — and we test beyond it either way. Undocumented and deprecated endpoints are frequently where the worst findings are, precisely because nobody reviews them.
Can you test APIs that have no UI?
Yes. Most of our API work is against services with no front end at all. We work from the specification, from traffic captures, or from the client applications that consume them.
How do you handle rate limiting during a test?
We agree limits in the rules of engagement and throttle to stay inside them. Where a limit is itself the subject of testing, we do that in an agreed window with your team watching.
Do you test gRPC?
Yes, including protobuf reflection where enabled, and authorisation testing across services in a mesh.
Next step
Find out what an attacker would find.
Tell us what you have built. You get a reply within one business day, an NDA, and a free 30-minute scoping call with the person who will do the testing.