API & web application security
Find the bug in your API before someone else does.
Fixed-fee security assessments for teams that ship fast. Authorized in writing, scoped
to assets you name, and delivered as a severity-ranked report with reproducible evidence and fixes —
within 48 hours of the testing window closing.
◆ Signed authorization before a single request
◆ Read-only proof, third-party data redacted
◆ Fixed fee, no surprises
Three ways to buy
Every tier includes a signed authorization, a scoped testing window, and the same
5-page report shape. No retainers required to start.
Quick check
$1,500 one day
- Web app + API surface
- Authentication & session handling
- Access control (IDOR / BOLA)
- Report in 48 hours
Full assessment
$3,500 three days
- Everything in Quick check
- Mass assignment & role/permission logic
- One mobile app (static + dynamic)
- CVSS-scored findings + remediation call
Retainer
from $1,500 per month
- Re-test after each release
- New endpoints covered as you ship
- Priority scheduling
- Same report shape, rolling
What you actually receive
One document, five pages, written for engineers and for whoever signs the invoice.
| Page | Contents |
|---|
| Executive summary | What was tested, what matters, what to do first — readable in three minutes. |
| Findings | Severity (CVSS), affected asset, impact in business terms. |
| Evidence | The raw request and response that proves it. Copy-paste reproducible. |
| Remediation | The fix, with the trade-off where one exists. |
| Scope & attestation | Every asset exercised, the window, and what was deliberately not tested. |
How it works
- You authorizeWe send a one-page authorization naming the exact assets and the testing
window. You sign; we load that same list into the tooling that enforces scope, so the paperwork and
the testing cannot drift apart.
- We test inside the windowWeb and API surfaces, authenticated and unauthenticated, with
availability treated as sacred: no load testing, no denial-of-service attempts, ever.
- You get the report in 48 hoursSeverity-ranked, evidence-backed, with fixes. A call if the
tier includes one.
- We re-test after the fixOn request, at no charge within 30 days — a finding is not closed
until the fix is verified.
Stop conditions, stated up front. If a test could affect
availability or touch real user data, it does not run — it is reported as a hypothesis with the
reasoning. On any unexpected exposure we stop and call your nominated contact before continuing.
Scope, enforced by code
$ scope-gate check api.client.com
ALLOW api.client.com in scope
$ scope-gate check legacy.client.com
DENY legacy.client.com NOT LISTED
A host that is not on your signed list
cannot be tested, no matter who asks.
Evidence, not adjectives
Every pitch should carry a delivered report. Here is one from our own infrastructure —
same pipeline, same shape as the report you would receive.
Sample finding · High
Dangling DNS on a branded API subdomain. The hostname
still resolved into our hosting provider while the deployment behind it had been retired, so nothing
of ours answered on a name the public would read as first-party. Fix: one DNS change, verified in
the report.
$ curl -sSD - -o /dev/null https://api.example.com/anything
HTTP/2 404
server: Vercel
x-vercel-error: DEPLOYMENT_NOT_FOUND
Read the full report →
Method
- Object-level access control (IDOR / BOLA) across every identifier the API accepts
- Mass assignment on write endpoints — fields the client should never control
- Authentication and token handling: algorithm confusion, unsigned tokens, claim trust, replay
- Role and permission checks, including read-only credentials used for writes
- Public-surface hygiene: dangling DNS, exposed staging hosts, leftover artifacts
Findings are reported with the smallest proof that
establishes impact. Third-party data is redacted; a report you cannot safely forward is a report
that failed.
Rules of engagement
Plain language, because this is the part that protects both of us.
- Written authorization first. Named assets, named window, named liability cap,
a nominated kill-switch contact. No signature, no testing.
- Window is binding. No traffic before the start or after the end.
- Availability is sacred. No DoS, no load or stress testing, no brute force of
live accounts.
- Minimum proof. Read-only evidence preferred; never alter, delete or export
data beyond the smallest sample that proves the finding.
- Third parties are out. Hosting providers, payment processors and vendors are
never in scope.
- Confidentiality. Findings stay private until you agree in writing to publish.
Questions about a specific asset being testable? Ask before we
start. If your provider's policy forbids a technique, we will not use it — we will tell you what we
could not test and why.
Sites already running
The other paid domains are live. This name was the empty one. The same pages are listed on
bountywarz.com/showcase.html.