Grey-box and source-led testing of APIs, backend services, web apps and an admin console. Services checked that a user was signed in, not what their role allowed, or left each route to opt into its own checks.
- findings across APIs, web apps and an admin console
- 160+
- rated critical
- 19
- end-to-end tests written to prove the findings and guard the fixes
- 535
- of access logs used to find endpoints nobody called
- 30 days
- Sector
- HR and talent-management SaaS
- Scope
- APIs, backend services, web apps, admin console
- Method
- Grey-box, source-led
- Delivered
- Report and a 535-test end-to-end suite
How we tested.
Grey-box and source-led
We tested the running applications as signed-in users and read the source alongside, so each finding traces back to the code that causes it.
Real traffic as evidence
We pulled 30 days of access logs to see which endpoints real users called, and which nobody had touched.
What we found.
Over 160 findings, 19 of them critical. The common thread was authorisation.
Signed in was treated as allowed
Services checked that a user was signed in, not what their role allowed them to do.
Authorisation was opt-in
Each route had to add its own checks, and a route that forgot had none.
Endpoints nobody used, still live
The access logs showed endpoints with no calls in 30 days. Those can be removed rather than patched.
What we handed over.
A report written for the fixer
Every finding reproduced and rated, with steps to reproduce, evidence and a specific fix.
A 535-test end-to-end suite
It proves each finding today and guards the fixes once they land.
A removal list
The unused endpoints, so they can be deleted instead of patched.
Client, product and module names are withheld. Counts as of October 2026.
VAPT
Hands-on testing of your web apps, APIs, mobile apps and networks. Every finding is reproduced, rated and comes with a fix.
Want numbers like these for your own systems?
contact@araval.in · We reply within one working day.