Authorized testing · United States & Brazil
SaaS penetration testing
Growing your product should not blur the boundaries between customers. I test how your SaaS separates organizations, members, and roles, including paths built quickly during development.
Discuss my projectOrganizations that stay separate
I assess whether the organization selected in the interface matches the resources the server allows an account to access. Scope can include context switching, invitations, member removal, and resource access after a role change.
Files have owners, too
Access controls need to cover uploads, download links, exports, and data outside the main screens. I examine available workflows and check whether a user can reach a file belonging to another organization.
AI-built code, real security requirements
Testing looks at product behavior regardless of how the code was written. I assess in-scope authentication, authorization, storage, and endpoints. This service is not a specialized AI-model assessment and does not promise to detect every vulnerability in AI-assisted code.
Illustrative scenario · fictional data
What this looks like in practice
Fictional example: a member is removed from an organization while their session remains active. Testing checks whether that session can still download a report or call an operation belonging to the organization.
What to prepare before testing
Prepare two test organizations, accounts with different roles, and invitation, role-change, and removal workflows. We identify integrations with real-world effects and agree on which operations can be exercised.
Do not send passwords, tokens, or customer data through the public form.
Questions about this service
Should a SaaS be tested before launch?
An assessment before opening the product to customers can reveal access-boundary problems. The environment needs to represent the workflows you will release, and significant later changes may need another assessment.
Do you fix the code during the pentest?
The deliverable includes technical guidance for your team. Code changes, implementation support, and retesting must be defined in the proposal; they are not assumed to be included in every assessment.
Let’s define the scope.
Tell me what your system does and what you need assessed. After reviewing the context, I send a proposal with boundaries, deliverables, timing, and price.
Discuss my project