I find the vulnerabilities in your application before an attacker does.

• REST APIs

  Object and function level authorisation, mass assignment, resource consumption, SSRF and sensitive business flows. I work from your OpenAPI specification or Postman collection.

  • API Top 10 2023
  • OpenAPI
  • Postman

  1. API1Broken Object Level Authorization
  2. API2Broken Authentication
  3. API3Broken Object Property Level Authorization
  4. API4Unrestricted Resource Consumption
  5. API5Broken Function Level Authorization
  6. API6Unrestricted Access to Sensitive Business Flows
  7. API7Server Side Request Forgery
  8. API8Security Misconfiguration
  9. API9Improper Inventory Management
  10. API10Unsafe Consumption of APIs

• Web applications

  Authentication, sessions, access control, business logic, injection and everything that happens in the browser: XSS, CSRF, CORS.

  • WSTG v4.2
  • ASVS 5.0

• GraphQL

  Introspection, batching and aliases, authorisation on nested fields, query depth and cost.

  • Queries
  • Mutations

• OAuth, OIDC and JWT

  redirect_uri, PKCE, state and nonce, algorithm confusion, token expiry and rotation.

  • RFC 9700
  • JWT

• White box

  With access to the code I test better and faster: a targeted review of the paths that concentrate the most risk.

  • Targeted review

• Retest included

  I verify every fix and deliver version 2 of the report with the status of each finding.

  • Report v2

 router.get('/v2/invoices/:id', auth, async (req, res) => {-  const invoice = await Invoices.findById(req.params.id);+  const invoice = await Invoices.findOne({+    id: req.params.id,+    customerId: req.user.customerId,+  });   if (!invoice) return res.sendStatus(404);   res.json(invoice); });

GET /v2/invoices/48214 HTTP/2Host: api.demo-corp.testAuthorization: Bearer eyJhbGciOiJSUzI1NiIs… (user A)Accept: application/json

HTTP/2 200 OKContent-Type: application/jsonCache-Control: no-store{  "id": 48214,  "customer": "usr_9102",  "tax_id": "B••••••••",  "item": "Annual licences",  "total": "€18,900.00"}

curl -i https://api.demo-corp.test/v2/invoices/48214 \  -H "Authorization: Bearer $TOKEN_A" \  -H "Accept: application/json"

[Full sample report in PDF] Download without a form, in English and Spanish.

1. Step 01

   Day 0

   Scope and authorisation

   A 30-minute call, written scope and authorisation signed by the owner of the systems.

2. Step 02

   Days 1–2

   Preparation

   Test accounts for each role, environment, OpenAPI specification or Postman collection, and emergency contacts.

3. Step 03

   Per scope

   Testing

   Manual and guided by OWASP WSTG and the API Security Top 10. If I find something critical, I tell you within 24 hours.

4. Step 04

   +3 days

   Report and wrap-up

   Report in English and Spanish with CVSS 4.0, CWE and the ASVS 5.0 requirement for each finding, plus a wrap-up meeting.

5. Step 05

   Up to 90 days

   Retest

   I verify the fixes and deliver version 2 of the report with the status of each finding.

• OWASP WSTG v4.2 +

  OWASP WSTG v4.2

  OWASP’s web testing guide: it structures the manual testing.

• OWASP ASVS 5.0 +

  OWASP ASVS 5.0

  Verifiable requirements, levels 1 and 2. Each finding cites its own, for example v5.0.0-8.2.2.

• API Security Top 10 2023 +

  API Security Top 10 2023

  The ten most common API risks. Each finding carries its category.

• CVSS 4.0 + CWE +

  CVSS 4.0 + CWE

  Scoring with the full vector and the root weakness of each flaw.

• ENS +

  ENS

  Reports aligned with Spain’s National Security Framework (RD 311/2022).

• NIS2 +

  NIS2

  Evidence of vulnerability management and control effectiveness (art. 21).

• DORA +

  DORA

  Testing under articles 24 and 25. Article 26 TLPT requires a red team.

• ISO/IEC 27001:2022 +

  ISO/IEC 27001:2022

  Evidence for Annex A controls 8.8 and 8.29.

• PCI DSS 4.0.1 +

  PCI DSS 4.0.1

  Requirement 11.4: regular penetration testing and fixing what is exploitable.

• GDPR art. 32 +

  GDPR art. 32

  Regular testing of the effectiveness of technical security measures.

Indicative, non-binding estimate; prices exclude VAT. Sample formula and rate for the mock-up: adjust them in src/data/estimator.ts.

• Cheat sheetComing soon

  API authorisation checklist: BOLA, BFLA and BOPLA

  The tests I run on every endpoint, with sample requests.

• Advisory[date]

  [CVE-YYYY-NNNNN · affected product]

  [Summary of the flaw, affected versions and patch]

• Tool[date]

  [Name of your tool]

  [What it automates and link to the repository]