Surface
Endpoints, versions, schemas, identities and data classes.
Security testing
API penetration testing
Test authentication, object and function authorisation, tenant isolation and business abuse paths in APIs. Validate specific attack paths with written authorisation and evidence an engineer can reproduce.
01 / Scope
Work on the system, not around it.
The engagement starts with the architecture and working constraints already in place. We agree the risky paths, make the changes visible and leave ownership with the team running the system.
Authorisation
Object, function, tenant and administrative boundaries.
Input and state
Validation, sequencing, concurrency and business rules.
Abuse resistance
Rate controls, automation, tokens, logging and response.
02 / Method
Validate specific attack paths with written authorisation and evidence an engineer can reproduce.
Scope and access are agreed before the work begins. Decisions, changes and residual risk remain visible throughout the engagement.
Authorise the scope
Start with evidence, owners and the constraints that shape the safe solution.
Exercise the paths
Prioritise by practical impact and implement with the people who operate the system.
Fix and retest
Test the changed path, document the decision and hand over a backlog that still makes sense.
03 / What remains
- 01Rules of engagement and endpoint scope
- 02Reproducible API findings
- 03Developer remediation readout
- 04Retest status and residual risk
Related work
Continue with the adjacent problem.
04 / Talk to Gritt
What is happening in the system?
Send the cloud, workload or deadline. An engineer will reply and tell you whether this is the right scope.
email