Identity
Registration, authentication, recovery, sessions and MFA.
Security testing
Web application penetration testing
Manually test web authentication, sessions, access control, input handling and business logic. Validate specific attack paths with written authorisation and evidence an engineer can reproduce.
01 / Scope
Work on the system, not around it.
The engagement starts with the architecture and working constraints already in place. We agree the risky paths, make the changes visible and leave ownership with the team running the system.
Authorisation
Roles, objects, tenants and administrative functions.
Input paths
Browser, server, upload, integration and rendering behaviour.
Business logic
Sequence, limits, state changes and abuse scenarios.
02 / Method
Validate specific attack paths with written authorisation and evidence an engineer can reproduce.
Scope and access are agreed before the work begins. Decisions, changes and residual risk remain visible throughout the engagement.
Authorise the scope
Start with evidence, owners and the constraints that shape the safe solution.
Exercise the paths
Prioritise by practical impact and implement with the people who operate the system.
Fix and retest
Test the changed path, document the decision and hand over a backlog that still makes sense.
03 / What remains
- 01Authorised test plan
- 02Executive and technical report
- 03Reproducible evidence and remediation guidance
- 04Retest letter or status report
Related work
Continue with the adjacent problem.
04 / Talk to Gritt
What is happening in the system?
Send the cloud, workload or deadline. An engineer will reply and tell you whether this is the right scope.
email