In-depth penetration testing for SaaS that needs to pass SOC 2, ISO 27001 and enterprise due diligence.

Every B2B SaaS shares the same risk pattern: one customer being able to see another customer's data. That's catastrophic — it breaches your contracts, violates data protection law (such as Brazil's LGPD) and kills the renewal. This type of bug is called BOLA (Broken Object Level Authorization), and it sits at #1 on the OWASP API Top 10.

BOLA doesn't show up in a scanner. It shows up when a researcher:

• Creates two accounts in different tenants
• Exhaustively maps every endpoint
• Tries swapping IDs across tenants
• Tests every endpoint with every combination of roles
• Looks for mass assignment in every form

That's the work No Vuln does. At scale. With a proprietary Auth Matrix that maps roles × endpoints × verbs automatically, and human review of every combination.

Multi-tenant isolation

• Cross-tenant BOLA on every endpoint (REST, GraphQL, WebSocket)
• Cross-tenant access via indirect parameters (cookies, headers, JWT claims)
• Leaks through search/filter endpoints
• Upload isolation (S3/GCS prefixes, CDN)
• Isolation in background jobs and queues
• Isolation in outbound webhooks
• Cross-tenant cache poisoning (CDN, Redis)

Single Sign-On (SSO)

• SAML — XML Signature Wrapping (XSW), assertion replay, IdP confusion
• OIDC — state confusion, redirect URI fuzzing, token swap
• SCIM — provisioning across IdPs, escalation via group membership
• Just-in-Time provisioning — tenant guessing via email domain
• Linking an SSO account to a password account — potential takeovers

OAuth 2.0 / OIDC (your APIs as the provider)

• Authorization Code flow — PKCE bypass, code injection
• Implicit / Hybrid flows — token leakage
• State fuzzing, redirect URI fuzzing, scope escalation
• Refresh token theft, rotation issues
• Confused deputy when your SaaS is an OAuth client of third parties

API hardening (OWASP API Top 10)

• BOLA (Broken Object Level Authorization)
• BFLA (Broken Function Level Authorization)
• BOPLA (Broken Object Property Level Authorization) + mass assignment
• Excessive data exposure
• Rate limit bypass via headers, IP rotation, batch attacks
• GraphQL: introspection abuse, alias overload, query depth bombs

Webhooks (outbound and inbound)

• SSRF via the webhook callback URL configured by the customer
• Replay attacks on the webhooks you send
• Signature bypass (timing attacks on HMAC, length extension)
• Race conditions in callbacks (a duplicate callback causing double processing)
• Webhook forgery (forging a callback that looks legitimate)

Billing and plan management

• Limit bypass through payload manipulation
• Race conditions on plan upgrades/downgrades
• Paywall bypass via direct API calls
• Coupon/discount manipulation
• Stripe/Adyen webhook signature bypass

Storage and exports

• S3/GCS bucket isolation
• Pre-signed URL leakage and long-TTL abuse
• Export endpoints — CSV/PDF injection, formula injection
• Path traversal in attachment downloads

Our reports can be delivered in the format required by the leading compliance frameworks:

• SOC 2 Type II — Common Criteria CC7.1 (vulnerability scanning + pentest), CC4.1 (monitoring activities)
• ISO/IEC 27001:2022 — Annex A control 8.29 (security testing in development and acceptance) and 8.8 (management of technical vulnerabilities)
• LGPD Art. 46 (Brazil's data protection law) — technical measures to protect customer data, for companies serving Brazilian users
• PCI DSS 4.0 — for SaaS that processes card data (requirements 11.4.x)

Your auditor wants a written pentest? Our report covers it. An enterprise customer asks for evidence? We send an executive summary formatted for the C-suite.

Every engagement gets a custom quote once the scope is defined. The hourly rate ranges from US$ 150 to US$ 250 depending on stack, testing mode and timeline — larger packages have a lower hourly rate. Invoiced in USD via Wise or international wire transfer: 50% at kickoff, 50% on delivery.