Is this a penetration test?

It is an application audit, with access to the code — more effective at finding flaws than a blind test, and much cheaper. If you need a certified penetration test for a contractual or insurance requirement, we will point you to a specialist firm.

Will you audit an application you built yourselves?

We do it continuously on our own applications, with automated checks sweeping every project. But for an audit that carries weight, an outside pair of eyes is better — and we say so rather than selling you our own review of our own work.

What if you find something serious?

We tell you immediately, before the audit is even finished, and propose a fix the same day if it is exploitable from the internet. The full report can wait; an open door cannot.

Secure

Security audit

We look for what an attacker would find, and tell you where to start.

The flaws we find most often are not sophisticated exploits. They are API endpoints that answer without checking who is calling, numeric identifiers you only have to increment to read the neighbour's file, access keys left in plain text in the code, and dependencies never updated since launch. We look in that order, because that is the order in which people get attacked. And we fix without destroying the traces: a patch that also wipes the logs stops you finding out whether you had already been visited.

The method

How we work

01
We check who is allowed to call what
Every API endpoint, one by one, with an account holding no rights and then with no account at all. It is the most widespread and most serious defect: access control done in the interface, but not on the server.
02
We test enumeration and access to other people's data
An identifier that increments, a guessable token, an unfiltered parameter. On multi-tenant applications we focus on proving one client cannot see another's data.
03
We hunt for exposed secrets
API keys in code sent to the browser, passwords in repository history, configuration files publicly reachable. A secret published once must be rotated, not merely removed.
04
We review dependencies and the server
Libraries with known vulnerabilities, security headers, open ports, admin interfaces reachable from the internet.
05
We prioritise and fix
Ranked by what is exploitable from the internet without an account, then by the severity of what would be obtained. We can fix it, or leave your team to work from the report.

What you get

Deliverables

check_circleThe report, each finding with step-by-step reproduction and its fix
check_circleRanking by real risk, not by a tool's theoretical severity
check_circleThe list of secrets to rotate, with the rotation procedure
check_circleA re-check after remediation, to attest that it is closed

The proof

Where we have done it

Gextra

Since 2010

Admissions, care records, staff scheduling, billing, mobile apps. A complete business system, being migrated screen by screen to modern technology without stopping the work.

Read the case studyarrow_forward

Notre flotte

Since 2010

Git, continuous integration, image registry, SSO, DNS, metrics, logs, monitoring: all of it runs on our own machines, on open-source components. Not out of principle — because it holds load better, costs a fraction, and does not stop when a vendor changes its mind.

Read the case studyarrow_forward

Frequently asked questions

Is this a penetration test?: It is an application audit, with access to the code — more effective at finding flaws than a blind test, and much cheaper. If you need a certified penetration test for a contractual or insurance requirement, we will point you to a specialist firm.
Will you audit an application you built yourselves?: We do it continuously on our own applications, with automated checks sweeping every project. But for an audit that carries weight, an outside pair of eyes is better — and we say so rather than selling you our own review of our own work.
What if you find something serious?: We tell you immediately, before the audit is even finished, and propose a fix the same day if it is exploitable from the internet. The full report can wait; an open door cannot.