Find the gap.
Before the attack.

I test web apps and APIs for access-control flaws. You get evidence, clear priorities, and practical guidance to fix them, with retesting as agreed.

Discuss my project

For teams building SaaS, APIs, and Shopify apps.

Authorized scopeReproducible evidenceEnglish and Portuguese

Access has boundaries.

Does your app enforce them?

A login screen does not answer the most important question: once someone gets in, what can they actually do?

One account. Which doors?

I test login, account recovery, sessions, and permissions. The focus is whether an ordinary user can act as an administrator or reach someone else’s data.

  • Login and sessions
  • Role-based permissions
  • Admin panels
  • Private data and files
Assess this scenarioExplore this assessment

A finding. With evidence.

You get the steps to reproduce it, the business impact, and what needs to change in the code. Every finding has to stand up to scrutiny.

Reproduction
Requests, responses, and steps your team can use to confirm the issue.
Priority
What the vulnerability makes possible and why it deserves attention.
Remediation
Guidance tied to the root cause, with retesting as agreed in scope.
Rust CybersecurityAuthorization review

Illustrative example · fictional data

New ID. Different owner?

GET/api/projects/project_b
Sessionuser_aOwneruser_b
200 OKAnother account’s data exposed

The server must verify resource ownership on every request.

Before the fix

From testing to fixing.

Scope

We agree on systems, test accounts, timing, and boundaries. Testing starts with authorization.

Investigate

I work through real workflows, combining manual analysis with tools for repetitive coverage.

Document

Confirmed findings, evidence, and recommendations go into a report your team can put to work.

Retest

Agreed retesting checks the fixes within scope and records anything that still needs attention.

Meet your tester.

I’m Junio Silva, founder of Rust Cybersecurity. I work on web application and API security, with a particular focus on who can access or change each piece of data.

I’m based in the United States and work in English and Portuguese. You speak directly with me about the scope, findings, and next steps.

LinkedInUpwork
Finding the flaw is the start. The next step is fixing it.Junio Silva

Before we start.

Do I need to authorize testing?

Yes. I only test systems you own or are authorized to have assessed. Scope and boundaries are agreed before any testing begins.

Will my system stay online?

Testing is planned to reduce impact. I prefer a test environment where possible, agree on limits with you, and avoid destructive tests. No security test is entirely risk-free.

Cost and timeline?

Cost and timing depend on functionality, access roles, integrations, and system size. After reviewing your project, I send a proposal with scope, price, and timeline.

How is data handled?

I use test accounts and data wherever possible, collect only what is necessary, and agree on evidence handling. Client findings are never published without permission.

Does a test guarantee security?

No. An assessment covers an agreed scope at a point in time. It helps find and fix vulnerabilities, but cannot guarantee that none remain.

Let’s take a closer look.

Tell me what you are building and what you need to protect. The first conversation helps us decide whether an assessment is right for your project.

Please do not send passwords, API keys, or customer data.