Application & API security.
Protect the action.
Not just the endpoint.
Security review of web applications and APIs, with attention to authorization, business logic and the boundaries between users, tenants and services.
Make the assumption
explicit.
A successful login does not establish permission to every object or action. We examine the decisions your application makes after authentication, including the assumptions distributed across gateways, handlers and background jobs.
Where we focus
- Model roles, ownership and tenant boundaries.
- Review server-side authorization and data exposure paths.
- Examine high-impact workflows, uploads and state transitions.
- Translate findings into targeted tests and maintainable controls.
Useful evidence.
A concrete next step.
The exact deliverables are agreed before the work begins. These are typical outputs, not an unlimited assessment commitment.
Application trust-boundary map
Scoped code and behavior review
Findings linked to engineering changes
Regression scenarios for agreed fixes
Precisely scoped.
Clearly understood.
An application review covers agreed components and scenarios; it cannot prove the absence of every vulnerability. Test accounts and safe fixtures are used wherever possible. Production changes remain under your release controls.
Three questions to bring
- Where does permission get decided?
- Which tenant or role must remain separate?
- Which action has the highest consequence?
Understand the boundary.
All technical guides
API object authorization: decide who can act on each record
A valid login does not establish access to every record. Turn object permissions into explicit rules and repeatable tests for your own API.
Read article
Deploying CSP: move from reports to controlled enforcement
Content Security Policy needs an application inventory, a compatible script strategy and a measured rollout. A pasted header is only the beginning.
Read article
A URL input is a network permission decision.
Design server-side fetch features around destination controls, restricted egress and observable failure instead of URL syntax alone.
Read articleStart with the boundary that matters.
Bring the system, the concern and the boundary you want to examine.