Find the access-control bugs scanners miss
A hands-on web app and API penetration test by a bug bounty hunter with 238+ accepted vulnerability reports. Fixed price, clear report, free retest.
Check the track record on HackerOne →
Who this is for
Getting SOC 2 or ISO 27001
Auditors usually expect a third-party penetration test. You get a report with scope, dates, method and results.
A big customer sent a security questionnaire
Answer "when was your last pentest?" with a recent report and close the deal faster.
Your app has users, teams or tenants
When customers share one system, a single broken permission check can leak everyone's data.
What gets tested
- Broken access control (IDOR / BOLA)
Can user A read or change user B's data? - Privilege escalation
Can a normal user do admin-only actions? - Tenant isolation
Can one customer reach another customer's data? - Authentication and sessions
Login, password reset, invites, tokens.
- Business logic
Abuse of pricing, limits, approvals and workflows. - APIs
REST, GraphQL and mobile app backends. - Common web flaws
XSS, SSRF, injection, file uploads (OWASP Top 10).
What you get
- A clear report
A summary for leadership, plus every finding with severity, proof, steps to reproduce and how to fix it. - A free retest
Fixed issues are retested within 60 days, with an updated report. - A letter you can share
A short confirmation of the test (scope, dates, outcome) for auditors and customers. - A walkthrough call
30 minutes with your team to go through the results.
per test, no surprises
- One web app and its API
- Up to 3 user roles
- 5–7 days of manual testing
- Report, letter and walkthrough call
- Free retest within 60 days
Bigger scope (several apps, mobile, more roles)? Ask for a quote.
How it works
Why not just run a scanner?
Automated scanners compare software versions against known CVEs. They can't log in as two different users and check whether one can see the other's invoices. Broken access control is #1 in the OWASP Top 10, and finding it takes a human who understands how your app is supposed to work.
Run a free CVEFinder scan for the quick check, then get a person to test what scanners can't.
Questions
Who does the testing?
Ganofins, a bug bounty hunter with 238+ accepted vulnerability reports and $100K+ earned in bounties, who specializes in access-control bugs. You work directly with the person testing your app. No sales team, no hand-offs.
Is it safe to test our production app?
Yes. Testing is careful and non-destructive: no denial-of-service, no deleting data, no social engineering, and only the test accounts you provide. If you prefer, the test can run on a staging copy instead.
What do you need from us?
The app URL, two test accounts for each user role (so access between accounts can be checked), API docs if you have them, and a contact person for urgent findings.
How long does it take?
Testing takes 5–7 working days, and the report arrives within 3 working days after testing ends. Most tests are finished 2–3 weeks after the first call.
Will auditors and customers accept the report?
The report covers what auditors and customer security teams usually ask for: scope, test dates, methodology, every finding with its severity, and retest results. Every auditor has its own rules, so you can share a sample report with yours before booking.
Can I see a sample report?
Yes. Ask for one in the form below and you will get a redacted sample.
Do you sign an NDA?
Yes, before you share anything. You also sign a short testing authorization so the scope is clear for both sides.
How do we pay?
By invoice in US dollars, paid by international bank transfer: 50% to book the test and 50% when you receive the report.