Offensive security2 min read
Broken object-level authorisation: the API bug behind most data leaks
BOLA tops the OWASP API Security Top 10. How it happens in a typical NestJS API, how testers find it, and the pattern that prevents it.
Know where your web app can be broken, before attackers do.
Every finding comes with proof you can reproduce and a fix your developers can apply. Each one is reviewed by a second tester before it reaches you.
What you gain
Proof of where an attacker could get in, with fixes your developers can apply
A report and attestation letter to show clients, partners and regulators
Confidence that the fixes worked, through a retest
Who it is for
- Fintechs and payment providers handling customer money
- SaaS startups selling to enterprises that ask for a pentest report
- Teams launching a major release or raising a round
What we cover
- Testing against the OWASP Web Security Testing Guide, ASVS and MASVS
- Authentication, authorisation and business-logic testing
- API testing, including broken object-level authorisation
- Android and iOS app testing where in scope
Questions clients ask
Do you test production or staging?
Staging, where it mirrors production. Production testing needs extra rules of engagement and agreed windows.
How is our data handled?
Findings are stored encrypted, shared only with the people on the engagement and deleted 90 days after the project closes.
Will you sign our NDA?
Yes, or we can provide ours.
Often paired with
Further reading
Tell us what you are building or worried about.
A 20-minute call is enough to know whether we can help and what it would involve. No pitch deck.