Security testing of web applications and APIs, measured against the OWASP Web Security Testing Guide, ASVS and the OWASP Top 10 lists, including the payment and authentication flows that compliance frameworks single out.
The core web app test: how a manual test mapped to the WSTG categories and the OWASP Top 10 2025 is scoped, run and reported, what authenticated versus unauthenticated coverage means, cost drivers, timeline and what the client prepares.
Testing REST and JSON APIs against the OWASP API Security Top 10 2023, with the focus on object and function level authorization, property level exposure, rate limits and undocumented endpoints; covers what specs, tokens and test accounts the tester needs.
GraphQL-specific testing: introspection exposure, field and resolver authorization, nested query and batching abuse, injection through arguments and insecure defaults, mapped to the OWASP GraphQL Cheat Sheet controls.
Focused testing of login, MFA, password reset, session handling and SSO integrations using SAML, OAuth 2.0 and OpenID Connect, measured against ASVS chapters V6, V7, V9 and V10, for teams changing identity providers or adding SSO.
Manual testing for flaws scanners cannot find: workflow bypass, price and quantity tampering, race conditions and abuse of sensitive business flows (API6:2023), and why it needs authenticated, documentation-led testing as CIS 16.13 and ASVS describe.
Testing checkout, payment page and payment API flows for tampering and script injection, tied to PCI DSS requirements 6.4.3 and 11.6.1 on payment page scripts and change detection, and to 11.4.1 application-layer testing.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.