Application security
Security testing for the applications you ship
We test web, mobile and desktop software the way an attacker would, then hand your engineers a report they can work from. Every finding comes with a way to reproduce it and a fix we have retested.
Our team holds OSCP+, OSWE, OSEP, eJPT and eWPT.
What we test
Web applications
Authentication, sessions, access control and the business logic your product depends on.
Mobile apps
iOS and Android builds, including local storage, transport security and how the app talks to your backend.
APIs
REST, GraphQL and internal services, checked for broken object level authorisation and data exposure.
Desktop clients
Windows and macOS software, focused on file handling, update paths and local privilege boundaries.
What you get
Reproduction steps
Written for a developer who has never seen that part of the codebase.
Severity and evidence
Each issue is ranked, with the request, response or screen recording that shows it.
A tested endpoints list
So you know what we covered and what sat outside the engagement.
A retest
We confirm which fixes closed and which ones did not.
How it runs
01
Scope
We agree what is in scope, what is out, and how to reach the people who can answer questions mid test.
02
Setup and timing
You give us access or a test window. We confirm the window in writing before anything starts.
03
Test
Manual testing, with tooling where it earns its place. Anything we find gets written up as we go.
04
Report and retest
You get the findings, a walkthrough call, and a retest once your team has shipped fixes.
Questions we get asked
How long does a test take?
A single web application usually takes one to two weeks of testing. Size, the number of user roles and how much is custom all move that number, and we confirm a window before you commit.
Do you need our source code?
Can you test production?
What happens after the report?
Tell us what you are building
A 20 minute call is usually enough to scope a test and give you a rough timeline.