SHIP FAST
SHIP TRUSTED.
In a multi-tenant platform, one missing authorisation check is every customer's data. We test tenant boundaries, API authorisation, and the pipeline that holds your production credentials.
THE SAAS THREAT MODEL
One authorisation bug is every customer
Multi-tenancy concentrates risk. A missing organisation check on one endpoint is not one finding, it is every tenant's data. Tenant boundaries are enforced in application code, usually in hundreds of places, and are only as strong as the least careful one.
You are an entry point to your customers
A platform with OAuth scopes into customer environments, or an agent on their hosts, is a supply chain position. Attackers targeting your customers may find it cheaper to target you. That is a different threat model from protecting your own data.
The pipeline is production
CI runners hold deploy credentials, signing keys, and cloud roles. In practice the shortest path to production data is frequently a workflow that trusts a pull request, a third-party action pinned to a tag, or a secret that outlived the engineer who created it.
WHAT DRIVES THE REQUIREMENT
For a SaaS business, testing is rarely optional. Enterprise buyers' security reviews, data processing agreements and SOC 2 commitments all assume the product has been adversarially tested.
SOC 2 Type II
Not a security standard so much as an evidence regime. Auditors and buyers expect independent testing against the controls you claim to operate.
ISO/IEC 27001
Annex A controls covering technical vulnerability management and secure development are commonly evidenced with penetration testing.
Customer security review
Enterprise procurement and vendor risk teams typically require a current independent test report and a remediation position before signing.
Contractual and DPA obligations
Data processing agreements often commit you to regular testing of the environment holding customer data, an obligation that outlives the deal that created it.
WHAT WE TEST
Tenant isolation & authorisation
- Cross-tenant object access (IDOR / BOLA) across every enumerable identifier
- Row-level and organisation-scoped enforcement in shared data stores
- Background jobs, exports, and reporting that bypass request-time checks
- Plan and feature-flag boundary escalation
- Invite, SSO provisioning, and role assignment abuse
API & integration surface
- REST, GraphQL, and WebSocket authorisation testing (gRPC case by case)
- GraphQL depth, aliasing, and introspection abuse
- OAuth token replay, scope escalation, and refresh handling
- Webhook signature verification and SSRF through outbound integrations
- Mass assignment, over-exposure, and pagination leakage
CI/CD & cloud pipeline
- Workflow injection and untrusted-input execution in GitHub Actions / GitLab CI
- Third-party action and dependency supply-chain review
- Cloud IAM privilege escalation and role assumption paths
- Secrets management, rotation, and exposure in build logs
- Artifact and container image integrity
HOW WE WORK
The work runs against the live tenant model, every role and tenant pair in parallel, with no black-box scanner dumps. A person decides what each finding means for your product.
Attack surface mapping
Enumerate the API schema, tenant model, identity flows, cloud footprint, and pipeline. In a SaaS engagement the schema is the scope document.
Threat modelling
Which adversary matters: a paying customer probing tenant boundaries, a credential-stuffing operator, or someone using you to reach your customers. Each implies different tests.
Agentic exploitation
Authenticated agents work every tenant and role pair in parallel, which is the only affordable way isolation failures surface, and chain what they find into demonstrated impact.
Evidence for engineering and for buyers
Findings your engineers can reproduce, plus control mappings and an executive summary that survives a customer security review without rewriting.
WHAT YOU RECEIVE
WHEN SAAS BREAKS
Public disclosures worth reading closely. Every one involved supporting infrastructure: support tooling, laptops, build systems.
Okta support portal
2023Access to the customer support case system exposed session tokens uploaded in HAR files by customers.
Support tooling holds production-grade secrets. It is rarely scoped like production.
CircleCI
2023Malware on an engineer's laptop stole a session token, giving access to production systems and customer environment variables.
Every secret stored in a CI provider had to be treated as compromised and rotated by every customer.
LastPass
2022A DevOps engineer's home workstation was compromised through unrelated software, yielding access to decryption keys for vault backups.
Backups exfiltrated once are attacked offline indefinitely. Tier-0 material needs isolation that survives endpoint compromise.
Codecov
2021A modified bash uploader script exfiltrated environment variables from customers' CI pipelines for months before detection.
A build-time dependency is a production dependency. Integrity checking of what your pipeline executes is not optional.
FREQUENTLY ASKED
Can you test staging instead of production?+
Usually, provided staging shares the production authorisation model and schema. Where it diverges, through a different identity provider, seeded data or disabled rate limits, the report names which findings could not be validated against the real configuration.
How do you test multi-tenancy without touching real tenants?+
We work from dedicated test tenants provisioned for the engagement, at least two, at multiple privilege levels. Cross-tenant attempts target our own tenants. If a genuine cross-tenant flaw exposes a real customer, we stop, report it through your incident channel immediately, and do not enumerate further.
Will the report hold up in a customer security review?+
It is written for that: scope statement, methodology, findings with evidence, control mapping, remediation status. No summary implies coverage beyond what was tested.
We deploy continuously. How does a point-in-time test stay useful?+
It does not, entirely. A test evidences a defined scope on a defined date. Where changes are frequent the durable value is in the systemic findings, the authorisation pattern and the pipeline trust model, plus targeted retesting of the changed surface.
Find out whether your tenant boundary holds under a paying customer
Send us your API schema and tenant model. We scope the engagement against that.