Authorized testing · United States & Brazil
API penetration testing
Your interface offers one path. Your API may accept many more. I test how endpoints respond when a request targets another resource, uses a different role, or includes data the interface would never send.
Discuss my projectWho can access each object?
Changing an identifier should not grant access to another account’s data. I check object-level authorization, including BOLA and IDOR scenarios, using test resources and an agreed permission model.
Sensitive fields and operations
Beyond reading a resource, a user may try to change fields they do not control or call a restricted function. I assess in-scope operations, the information returned in responses, and behavior when requests depart from the normal interface workflow.
Coverage connected to your product
An endpoint list does not describe every business rule. I use documentation, roles, and workflows to define meaningful scenarios. The report separates confirmed findings from limitations and operations that could not be tested, so you can see what the assessment covered.
Illustrative scenario · fictional data
What this looks like in practice
Fictional example: an account in organization A requests an invoice using an invoice ID from organization B. The server should deny access. Knowing the identifier should not grant permission to read the document.
What to prepare before testing
Share available documentation, such as OpenAPI or a request collection, without putting secrets in the contact form. We then agree on a channel for test credentials, roles, sample resources, and request limits.
Do not send passwords, tokens, or customer data through the public form.
Questions about this service
Do you only test public APIs?
No. An authenticated API can still be exposed to users with legitimate accounts. The scope can include both authenticated and unauthenticated operations, depending on the architecture.
Does this include load or denial-of-service testing?
Not by default. Load and denial-of-service testing are outside this offering. Request limits and operations with external effects are agreed before work begins.
Let’s define the scope.
Tell me what your system does and what you need assessed. After reviewing the context, I send a proposal with boundaries, deliverables, timing, and price.
Discuss my project