APIs are where the real attack surface lives now.
Most modern apps are thin clients on top of a wide API. We test the surface adversaries actually probe — unauthenticated paths, broken object-level auth, JWT misuse, GraphQL introspection abuse, mass assignment.
- Duration
- 2–3 weeks
- Protocols
- REST · GraphQL · gRPC
- Method
- OWASP API Top 10+
- Retest
- Included
What we test
OWASP API Security Top 10
Broken object-level auth, broken auth, excessive data exposure, lack of rate limiting, broken function-level auth, mass assignment, security misconfig, injection, improper assets, insufficient logging.
Authentication paths
Token issuance, refresh flow, JWT validation, OAuth flows, API key handling, signed-request schemes.
Authorization at every endpoint
Not just the obvious ones. Authorization tested on every method × resource combination. This is where IDOR lives.
GraphQL specifics
Introspection exposure, deeply-nested queries (DoS), batched queries, field-level authorization, fragment abuse.
Rate limiting & abuse
Per-user, per-IP, per-endpoint. Account creation, password reset, OTP, login — the abuse surfaces.
Schema & data exposure
Excessive data exposure in responses, sensitive fields leaking via includes/expands, mass assignment vulnerabilities.
Lightweight scoping, deep testing
- 01Week 0
Scoping & schema review
API documentation, schemas, and role tiers reviewed. Test accounts provisioned at each tier.
- 02Week 1
Authn & authz testing
Authentication flows and authorization on every endpoint × role combination. This is the bulk of the work.
- 03Week 2
Logic & abuse testing
Business-logic abuse, rate-limiting, schema exposure, GraphQL-specific testing (if applicable).
- 04Week 3
Report & retest
Findings with reproduction steps and remediation. 30-day retest included.
What you walk away with
- Per-endpoint authz validation report
- JWT/OAuth/session findings with remediation
- GraphQL-specific findings (if applicable)
- Rate-limiting and abuse-surface coverage map
- Engineering-ready remediation guidance
- Audit-evidence for SOC 2 + ISO 27001