SaaS & Platforms
We help B2B SaaS and platform teams protect customer data at scale. Our focus: multi-tenant isolation, RBAC/ABAC done right, SSO/SCIM, API & webhook security, rate limiting & abuse defenses, and CI/CD supply chain hardening.
Why it matters
- • Prove tenant isolation to enterprise buyers
- • Prevent cross-tenant data access and privilege creep
- • Secure SSO/SAML/OIDC and lifecycle via SCIM
- • Stop enumeration, carding, and bulk-scrape abuse
- • Reduce pipeline/secret leaks in CI/CD
- • Deliver audit-friendly evidence (SOC 2/ISO 27001)
What we test
- Multi-tenant isolation: org/tenant scoping, RLS/filters, cross-tenant IDOR, cache key isolation, object storage prefixing, export/report scoping, background jobs and webhooks executing in the correct tenant.
- RBAC/ABAC: role definitions and custom roles, permission checks on every path, policy bypass (mass assignment, hidden fields), “support/admin” break-glass review.
- Authentication & SSO/SCIM: OIDC/SAML flows, JIT provisioning, role mapping, IdP-initiated risks, fallback/password bypass of SSO, SCIM deprovision drift, session fixation/CSRF.
- APIs & webhooks: BOLA/BFLA, rate limiting and anomaly detection, idempotency keys, pagination/snapshot leaks, webhook signature verification, replay/timestamp windows, outbound SSRF.
- Abuse & resilience: org/user discovery, invite/reset flows, trial/plan abuse, burst scraping, GraphQL depth/complexity limits, feature flag gating of admin actions.
- CI/CD & supply chain: secret hygiene in repos/images/logs, build isolation, provenance/signing (e.g., Sigstore), dependency pinning/SBOM, OIDC to cloud with least privilege, environment drift and artifact exposure.
- Cloud & data: IAM least privilege, KMS, backups/snapshots, data residency and deletion, audit log integrity, network segmentation, egress controls.
Sample test cases
- Cross-tenant read via
?tenantId=tampering or missing row filters - SSO enabled but local password still active for admins (SSO bypass)
- SCIM deprovisioned user retains API token or session
- BOLA: access another tenant’s resources by guessing IDs/UUIDs
- Webhook replay or signature bypass routes events to the wrong tenant
- GraphQL query without depth/cost limits → high-cost enumeration
- GitHub Actions OIDC mis-scope grants prod cloud access to CI
- Object storage prefix traversal leaks other tenants’ exports
What you get
- • Proof-of-exploit with safe evidence
- • Reproduction steps engineers can follow
- • Fix-first guidance with code/config examples
- • Severity mapped to tenant-breakout and business impact
- • Executive summary + audit-friendly artifacts (SOC 2/ISO 27001)
- • Rapid re-test to verify remediation
Who we’re best for
B2B SaaS and platforms, marketplaces, devtools, data/AI platforms, and products with enterprise SSO, custom roles, and webhook ecosystems.