01 / APPLICATION
Web applications & APIs
User journeys, endpoints and interactions between services.
PENTESTING WITH TIBEX
Find where your
product is vulnerable.
We investigate web applications and APIs using our own AI engine. You receive confirmed findings, a clear explanation of impact and guidance for remediation.
01SCOPE OF RESEARCH
Where your product
holds its value.
We define the scope with your team: what matters, which access is needed and where the boundaries of the engagement lie.
02 / AUTHORIZATION
Access controls
Boundaries between public and private data, user roles and available actions.
03 / BUSINESS LOGIC
Business logic
Payments, feature entitlements and sequences of actions that your product depends on.
02THE PROCESS
From context
to evidence.
Every stage has a concrete output. You know what we’re investigating and what your team will receive.
Agree on applications, APIs, user roles and permitted actions.
↳Agreed assessment scope
Map the surface and business logic. Form and investigate hypotheses.
↳Surface map and scenarios
Reproduce the result and examine alternative explanations.
↳Evidence and impact boundaries
Bring priorities, reproduction steps and recommendations to your team.
↳Report and remediation plan
03WHAT YOUR TEAM RECEIVES
Everything for
the next step.
In the report, each finding connects a specific observation to its impact and a path to remediation.
Open the sample reportTIBEX / ASSESSMENTTX—014
From a finding
to a fix.
01
Priority
What needs attention first.
02
Reproduction
The conditions and steps that produce the result.
03
Evidence
Requests, responses and demonstrated impact.
04
Remediation
Guidance and conditions for retesting.
THE DELIVERABLE
BEFORE WE START
Common questions.
01What do you test?
Web applications and APIs, including access controls, business logic and interactions between components. We agree on the systems, roles and permitted actions before work begins.
02What will our team receive?
A report with confirmed findings, priorities, reproduction conditions and steps, supporting evidence and remediation guidance. You can explore a sample format on the site.
03How long does a pentest take?
Timing depends on the size of your product, the number of roles, available access and the agreed scope. We discuss the schedule alongside the scope before work begins.
04How does retesting work?
We revisit the conditions of the original finding and check whether the issue can still be reproduced after the changes. Scope, timing and whether retesting is included are agreed for your engagement.
05How do we start?
Send your email, product URL and a short description of what you need. We will discuss what to investigate, the access required and what your team will receive. Testing begins once the work is agreed.
YOUR NEXT MOVE
Let’s talk about
your product’s security.
Show us what you’re building. Let’s work out how to put its security to the test.