Your APIs and callbacks.
The real center of risk.
In many applications, the critical flaw is not on the landing page or the login. It sits in a business API, a forgotten admin route, an unsigned webhook, or technical documentation that says too much. This audit focuses on those surfaces.
What we verify
REST, GraphQL, and public documentation
Swagger/OpenAPI, introspection, undocumented routes, technical responses, data models, and blueprint exposure from the outside.
Access control and object isolation
IDOR, roles, user/tenant separation, exports, admin endpoints, business logic, and the real level of auth enforced.
Mass assignment, validation, and errors
Unexpected parameters, overpowered fields, verbose errors, and price, status, or role logic the client can still influence.
Webhooks and automations
HMAC, header auth, Stripe callbacks, n8n, Make, CRM flows, payment, onboarding, and workflows able to create or modify data without strong identity guarantees.
What we often find
Public docs that are extremely useful to attackers
Swagger or GraphQL provides a near white-box view of the API while the team still thinks it is only exposing a frontend.
Objects reachable with the wrong user
Changing an identifier, filter, or parameter is enough to view or modify another customer record.
Unsigned or over-trusting webhooks
A callback without meaningful signature validation can replay a payment event, create an account, or trigger internal automation.
Business logic delegated to the client
Price, role, status, tenant, or amount still gets decided too close to the browser or the external integration.
Ideal for
- SaaS and business platforms whose real value is exposed through APIs and automations
- Stacks exposing REST, GraphQL, Swagger docs, payment callbacks, or n8n/Make webhooks
- Teams responding to enterprise security questionnaires centered on API security
- Products that want to validate exposed business logic before a client or attacker does
Related reads and pages
6 GraphQL vulnerabilities scanners miss
A strong companion piece if your GraphQL surface is rich or weakly segmented.
n8n webhooks: why your automations are vulnerable
The classic pattern of a webhook left visible in public JavaScript.
Dangerous WordPress REST API endpoints
A concrete example of how underestimated API surface appears on a very common CMS.
Passive audit methodology
How we verify an API or webhook without turning it into an intrusive pentest.