You built fast, possibly with a lot of generated code, and it works. The question you can't answer is what it does when someone hostile pokes it. That is a two-day question, not a quarter-long program.
Book a Starter scan — $1,000See what you'd getThe button is hidden for non-admins. The endpoint behind it is not. Change one ID and the data comes back.
Very commonAn API key that was meant for the server, shipped to the browser, readable by anyone who opens devtools.
CommonPassword reset, OTP entry and login accepting thousands of attempts a minute from one address.
A URL, written permission to test it, and twenty minutes on a call. Test credentials if you want logged-in areas covered.
Effectively nothing during the test. One hour afterwards, walking through the findings with us.
"Independently tested in March, all critical and high findings closed and re-tested." That sentence answers most customer security questionnaires.
Earthshaker SecurityWe find the cracks before they do. Automated and human-verified security testing for web applications.
earthshakersecurity.com · contact@earthshakersecurity.com
Earthshaker Security