Web application and API penetration testing
The model sits in an ordinary application with logins, sessions, permissions and an API. The pentest finds vulnerabilities in that layer before someone else does, and the report comes with a free retest.
Book a free consultationWho it is for
- Applications with an AI component (the AI + API Pentest package)
- Classic web and API applications of startups and software houses
- Companies under NIS2 and DORA
What gets tested
- OWASP Top 10 and OWASP API Security Top 10
- Authentication and sessions
- Authorization: IDOR, privilege escalation, access between tenants
- Input validation: injection, XSS, SSRF
- Configuration: headers, TLS, CORS, cookies
- Business logic
- Secrets and error handling
- Dependencies with known CVEs
- In AI applications, also the model endpoints and their limits
How the testing works
Following the OWASP Web Security Testing Guide (WSTG) and ASVS, black-box or gray-box (with a test account), manually and with tools: Burp Suite, nuclei, custom scripts.
No DoS, no social engineering, no testing on production outside the agreed window.
What you get
- A report: executive summary, findings with CVSS, steps to reproduce, recommendations
- A walkthrough meeting
- A free retest if the fixes are ready within 30 days of the report, and an updated report
- A “Tested by codequality.pl” badge after the retest
Packages
| Package | What it includes | Time |
|---|---|---|
| Web / API Pentest | classic pentest without the AI layer, per OWASP ASVS, report, free retest | approx. 10 working days |
| AI + API Pentest | AI Security Review + pentest of the API and web application around the model (ASVS L1/L2); one report, free retest | approx. 15 working days |
| Recurring Pentest | web / API pentest repeated every quarter, report and free retest | quarterly |
Frequently asked questions
Black-box or gray-box?
It depends on the goal. Gray-box with a test account lets the test check authorization and access between tenants; black-box shows the view from outside. We choose on a call.
Can a pentest harm production?
No DoS or social engineering, and on production testing happens only in the agreed window.
Is the report useful for NIS2 or DORA?
Yes, as technical evidence of security testing. The formal audit is done by an auditor or a law firm.
Our application also has an AI layer. Which package should we pick?
AI + API Pentest: testing of the AI layer and a pentest of the application around the model, in one report.
Contact
A few sentences are enough: what your application does, where it uses AI and what you want tested. The reply comes within 1 working day, with a proposed time for a free call.