Tenant and object isolation
Test cross-account access to records, files, exports and shared resources. Follow object identifiers through the API to check ownership and tenant scoping.
Services / SaaS & APIs
SaaS & API security reviews
Check whether each user can access only the data and actions they should. Manual application security reviews for startups preparing for customers, a launch or a change in permissions.
Discuss your scope in a 15-min callFollow the permissions behind the interface.
Hiding an action in the UI does not establish whether the API enforces it. A review compares what each role should be able to do with the requests the application actually accepts.
We use agreed test accounts and workflows to examine tenant isolation, account transitions and business rules. The result is a scoped account of what was tested, what failed and how to address it.
Where the review focuses
Roles and authorization
Compare member, administrator and other agreed roles. Check actions that should require different permissions, including those the interface does not expose.
Accounts and sessions
Review the agreed login, recovery, invitation and role-change flows, including what happens to access when an account’s state changes.
API inputs and business logic
Check input handling and workflows run in unexpected orders. Investigate whether server-side rules hold when requests bypass the usual interface sequence.
Choose the scope around your product.
Tell me what is changing and what a user must never be able to see or do. We choose the application, roles, priority workflows and testing window together. The written scope makes exclusions and access requirements explicit before testing starts.
For products with an assistant or agent, the AI and LLM testing scope also covers retrieval and tool permissions. We can discuss both surfaces in the same scoping conversation.
A report your engineers can act on
The Security Review includes prioritized findings, evidence, reproduction steps, recommended fixes, a plain-language summary letter and one retest of agreed fixes. Coverage and limitations are recorded alongside the findings.
View the fictional sample report, or follow the BOLA lab case study from an unauthorized request to the ownership check it needs. The SQL injection lab example includes a fix reproduction and regression check.
Pricing and the next conversation
The Security Review is a manual penetration test of one agreed application or AI workflow, priced at $2,000, with documented findings, remediation guidance, a summary letter, a results call and one retest; my first three clients pay a founding rate of $1,500. Review + Fix starts at $3,000 and adds implementation of specifically agreed fixes; the final price depends on remediation scope. Ongoing Security Support is $1,000 per month after an initial review, with up to eight hours monthly across selected change reviews, targeted testing, fix verification and consultation. A $500 scoping session is credited toward a Security Review booked within 30 days. Larger work is quoted separately. Compare all plans.
Bring a product overview, your user roles, priorities and any customer deadline. Turnaround is agreed after scoping. If the review is for a customer’s security process, share their requirements first; acceptance remains their decision. See common security review questions.
Your next step
Talk through your product.
Bring your product, your timeline, and the questions your customers are asking. We’ll use a 15-minute call to discuss fit and scope.