Authorized Web & API Security Assessments

Penetration testing and API security for your business.

DRG0NF1Y combines analyst-led testing, structured evidence, and guided remediation. Every engagement requires written authorization, an explicit allowlist, prohibited-action rules, rate limits, and a defined testing window.

Request API Security Scan Request a scope call

This is a professional penetration-testing service for systems you own or authorize us to test. We agree on the scope and service fee before work begins.

Scope before tooling

No arbitrary targets. Written authorization and a validated domain allowlist are required before a workspace can be queued.

Automated + analyst review

Scoped checks collect potential issues. An analyst reviews the evidence and validates findings before client delivery.

Human validation

Potential findings remain drafts until an analyst verifies impact, removes false positives, redacts sensitive material, and approves client visibility.

Remediation and retest

Validated findings flow into your dashboard for status tracking, remediation guidance, and documented retesting.

What the API scan checks

🔐

Broken Authentication

No-token and invalid-token access attempts on in-scope endpoints.

🌐

CORS Misconfiguration

Wildcard origins, credential reflection, and untrusted domain acceptance.

🚦

Rate Limiting

Checks whether the API returns 429 responses under rapid requests.

🛡️

Security Headers

HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and more.

📂

Sensitive Endpoint Discovery

/api/admin, /swagger, /.env, /graphql, and other common paths.

🔧

HTTP Method Enumeration

TRACE, TRACK, and dangerous method detection.

🔒

HTTPS Enforcement

Verifies HTTP redirects to HTTPS rather than accepting plaintext.

📋

Error Disclosure

Stack traces, framework names, or internal paths in error responses.

Pricing

Clear, flat pricing for authorized testing.

API Security Scan

$499

Automated OWASP API Top 10 passive checks on your authorized endpoints, every finding validated by a human analyst, delivered in your dashboard with remediation steps.

All 8 check categories listed above
Analyst-validated findings — no raw tool dumps
One free retest of fixed findings within 30 days
1–2 business day turnaround

Extended Web & API Assessment

from $1,499

Deeper manual testing beyond passive checks: authentication and session flows, access-control (IDOR) review, input validation, and business-logic review across an agreed scope.

Manual analyst testing, scoped in writing
Full findings report with evidence
Remediation guidance and one retest round

Custom Engagement

Quoted

Multiple applications, recurring assessment schedules, or compliance-driven scopes. Priced per engagement after a scope call.

Book a Scope Call

All engagements require written authorization before any testing begins. Invoiced after scope confirmation — no payment is taken on this page.

API Security Scan — Add-On for Business Clients

Request an Automated API Security Scan

Submit your API base URL. Our automated system runs OWASP API Top 10 passive checks against your authorized in-scope endpoints. An analyst reviews all findings before they are released to you. Requires login.

Strict boundaries — always enforced

Authorized assets onlyNo denial of serviceNo persistenceNo destructive changesNo credential stuffingNo testing outside scopeRate-limited to ≤2 req/secHuman review before delivery