Application security
Testing for the products you ship: web, API, mobile, desktop and AI features, where one user or customer might reach data or actions that belong to another.
- Web, API, mobile, desktop and AI
- Human-led
- Retest included
-
Led by a personTooling supports, testers decide
-
Scoped firstRoles, tenants and environments
-
Backed by proofFindings reproduced
-
Followed by a retestIn-scope fixes checked again
Assessments in this area
Web application testing
Authentication, authorisation between roles and tenants, injection and business-logic abuse.
Explore →API security testing
REST and GraphQL APIs tested for object-level authorisation, data exposure and chained abuse.
Explore →Mobile application testing
Android and iOS apps with their backend APIs.
Explore →Desktop and thick-client testing
Electron and classic clients: IPC, local secrets and update channels.
Explore →AI and LLM security testing
Prompt injection, tool abuse, data leakage and authorisation failures.
Explore →Latest application research
Recent write-ups on application and platform vulnerabilities, with patch, hunt and hardening steps for defenders.
Frequently asked questions
Should web and API be tested together?
Usually. Most web apps are front ends to an API, so testing both avoids gaps.
Do you test AI features inside an existing app?
Yes. AI features can be added to a web or API scope or tested on their own.
SaaS tenant isolation review
Anonymised multi-tenant SaaS isolation review from PoCForge: the testing approach, the finding classes uncovered and how the remediation retest was run.
Read the case study →- Human-led
- Retest included
- Scoped before any active work
Not sure which one fits?
Describe the system and what worries you. We reply with a suggested scope.
Request a free scope review →