API development
APIs with object level authorisation, rate limiting and clean contracts built in.
- Object and function level authorisation
- Token and key management
- Schema validation on every request
- Rate limiting and abuse controls
- Minimal, well shaped responses
- Versioning and documentation
The business problem
APIs are now the most direct route to your data. Authorisation that is added later is authorisation that gets missed.
Scope of work
Scope is agreed with you before any work starts. A typical engagement covers the areas below, adjusted to your environment, your priorities and any testing windows you need.
- Object and function level authorisation
- Token and key management
- Schema validation on every request
- Rate limiting and abuse controls
- Minimal, well shaped responses
- Versioning and documentation
Methodology
Security is considered at every stage, not checked at the end.
- Discovery
- Threat modeling
- Architecture
- Secure build
- Code review
- Security testing
- Release
- Support
Typical engagement timeline
Depends on scope. Planned in milestones.
Standards and references
- OWASP API Security Top 10
- OWASP ASVS
Tools and techniques
- REST and GraphQL
- Contract testing
- GARUDX code analysis
- Continuous integration
What you receive.
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Benefits
- Fewer vulnerabilities reach production
- Lower cost than fixing after launch
- Security evidence for your customers
- A codebase your team can maintain
- Architecture and threat model
- Source code and build pipeline
- Security test results
- Deployment and handover notes
- Post release support
Why us.
- Experienced security professionalsAssessments are led by practitioners who do this work every day.
- Offensive security expertiseWe think like attackers because that is our core discipline.
- Manual validationEvery finding is confirmed by a person before it reaches your report.
- Enterprise focused assessmentsScoping, communication and reporting that fit large organisations.
- Transparent reportingEvidence, reproduction steps and plain language. No padding.
- Actionable remediationSpecific fixes your developers and administrators can apply.
Questions.
Do you security test what you build?
Yes. Every build goes through code analysis with GARUDX and security testing before release.
Can you work with our existing team and stack?
Yes. We can build alongside your developers or deliver a complete product, using the stack that fits the project.
Who owns the source code?
Ownership terms are agreed in the contract before work begins.
Do you support the product after launch?
Yes. Support and maintenance terms are agreed as part of the engagement.