Security assessment

Application security assessment

We test your web app, API, SaaS platform or AI app inside a scope you agree in writing. Each finding comes with evidence you can check and a fix.

What we assess

• Web applications: sign-in, sessions, roles, forms, uploads and the JavaScript the browser runs.
• APIs: REST and other HTTP APIs, with a focus on who may read or change which record.
• Multi-tenant SaaS: whether one customer's account can reach another customer's data.
• AI applications: LLM apps, agents and MCP servers, as scoped assessments.

How we test

An assessment is black-box by default: we test the running system from the outside, as each user role in scope. The methods we use:

• Direct HTTP requests to the application and its API.
• Tests in a real Chromium browser, for problems such as CSRF and stored XSS that only show up there.
• Review of the client-side JavaScript bundles.
• Comparison of the same request sent anonymously and signed in.
• Read-back from a second account, to prove that a change crossed from one account to another.

The lab's AI testing agents do the repetitive part. They split the work into tasks and run them in parallel. Every tool they can use has a rule for your scope: it runs on its own, waits for approval, or is blocked. Excession Labs checks the evidence for each finding and writes the report.

What counts as a finding

A finding needs evidence of a real effect. A "success" response alone is not proof. If a request claims to change another account's record, we read that record back through the other account's session.

We send control requests next to each exploit request: identifiers that do not exist, the wrong record type, unsigned or wrongly signed cookies, another account's token, and anonymous calls. When a control holds, the report says so in a "Controls that held" section, so your fix does not break a protection that already works.

Evidence carries a label. "Observed" means we reproduced it. "Browser-observed" means we saw it in a real browser. Inferred attack paths are labeled separately, and open questions go into their own section instead of into the confirmed impact.

For a worked example of this method on a small local API, read Authorization testing for APIs.

More worked examples from the lab, each with source and raw responses: OWASP API Top 10 tests, IDOR, broken access control, SQL injection and SSRF. See all research notes.

Safety limits

• We test only with written authorization from the system owner.
• Destructive proofs use only accounts and records we create for the test, marked as test data.
• Tests of uploads, password guessing, email sending and paid third-party APIs have limits, and the report states what they cost.
• Reproduction scripts are read-only where possible. Run them only with authorization and test-owned identifiers.

What the report contains

You get the report as HTML, PDF and Markdown, with proof-of-concept scripts. Requests and responses are saved with timestamps, and key evidence can carry a SHA-256 manifest.

• Scope, assets and the severity scale
• Assessment method, safety constraints and evidence labels
• Executive summary with priority actions, and the findings at a glance
• One section per finding: description, impact, verified results, reproduction and remediation
• Controls that held
• Remediation plan
• Limitations and open questions
• Evidence index and an appendix of reproduction scripts

To see these sections filled in, read the sample report. It is a full report, written for a fictional app.

Severity uses four levels: Critical, High, Medium and Low, each with a written definition. We do not add CVSS vectors by default. If your program needs CVSS, tell us during scoping.

How to start

We begin with a short call about what you need. Then we send a written scope and proposal. Prices are quoted after scoping. Testing starts only after the system owner signs the authorization. After you fix the findings, we can retest them.

For a first test at no cost, apply for the free pilot (on penetrationtestservices.com, our pentest site). It covers a small written scope, and you keep each finding.