ceronWeb application security audit
Find out whether your customer portal protects the accounts, records, and business actions behind the login.
Explore coverageSecurity assessments.
Types, scope, and evidence.
A security assessment examines a defined system for weaknesses and records the evidence, impact, and limitations of the review. Use this guide to choose what to test, what access to provide, and what a useful result should contain.
Choose the boundary you need to understand.
Web application, API, and cloud describe what is tested. Vulnerability assessment and penetration testing describe the depth and method. One engagement can combine several boundaries, but each needs an explicit scope.
A public check, an audit, or deeper testing?
Start with the question you need answered. These options provide different kinds of evidence; the right choice depends on the systems and access you can authorize.
| Option | What it helps answer | Access and next step |
|---|---|---|
| Free website checker | What headers, cookies, CORS policies, and HTTPS behavior does this public response expose? | A public URL. No login or installation. It cannot test authenticated roles or establish that the whole application is secure. |
| Scoped security audit | Which weaknesses can be verified in the agreed application, API, or cloud environment? | Authorized assets and any agreed test accounts or configuration access. Core audits start at $1,500. |
| Extended assessment | Can a weakness be exploited or combined into an attack path within the authorized scope? | Explicit testing methods, boundaries, and stop conditions. Extended audits start at $3,500. |
What does useful security evidence look like?
A label such as “access control issue” leaves the important questions unanswered. Connect the identity, resource, action, and observed outcome. These original planning examples use synthetic data; they are not customer findings.
| Question | Bounded test | Evidence to retain |
|---|---|---|
| Can customers see another tenant’s records? | Use member A to request an A-owned invoice, then a synthetic B-owned invoice. | Identity, tenant, record owner, request, response, and whether protected data was returned. Tenant test matrix → |
| Does revoking an integration key remove access? | Make an authorized test request, revoke the key, then repeat the same request. | Key identifier without its secret, revocation time, response, and any access that continues. API key review → |
| Can an old download link still expose a file? | Use a synthetic file to compare link behavior before and after access is removed. | The intended link-expiration policy, permission-change time, and receiver-side result. Download access guide → |
| Can an AI tool act outside its user’s permissions? | Ask a read-only test user’s assistant to change a disposable test record. | Principal, tool arguments, authorization decision, and final record state. AI test checklist → |
| Can a retry duplicate a business action? | Replay an agreed synthetic event with the same operation identifier. | Event and operation IDs, processing decisions, and resulting state. Webhook review → |
A denied test is evidence for that case, not proof that every access path is safe. Record untested roles, routes, environments, and alternate delivery paths separately.
Prepare a scope that can actually be tested.
1. Define the decision
State what prompted the review: a launch, a new integration, changed permissions, or a customer request. Identify the assets and business actions that decision depends on.
2. Supply representative access
List authorized hosts and environments, provide agreed test roles and synthetic records, and identify third-party boundaries. Missing access becomes a coverage limitation.
3. Agree on safe operating limits
Define allowed methods, exclusions, traffic limits, timing, stop conditions, and the person who can authorize a restart. A public hostname is not permission to test it.
4. Specify the deliverable
Ask for affected assets, evidence, business impact, recommended fixes, and tested versus untested coverage. Agree on whether remediation support and retesting are included.
Evidence your team can act on.
Every audit includes an agreed asset inventory, finding validation, severity and business impact, an executive summary, and a technical report with prioritized remediation guidance. Coverage limits are documented alongside the findings.
The fee is fixed before testing. It applies only if a verified, actionable vulnerability is found within scope. Remediation implementation and follow-up testing are separate unless included in the engagement.
Prepare with Ceron’s free worksheets and testing resources →References and related guidance
The OWASP Web Security Testing Guide provides detailed web-testing guidance. The OWASP API Security Top 10 describes common API risk categories. Use these references alongside your application’s actual workflows; a category list does not define complete coverage.
This guide and its examples are by Mario Luckeneder, founder of Ceron. Updated . For deeper explanations, read vulnerability assessment vs. penetration testing and automated vs. manual assessments.
SCOPE BEFORE TESTING
Start with the boundary that matters.
Bring the systems you want reviewed and the decision you need to make. We agree on assets, access, testing methods, timing, and a fixed fee before work begins.
Discuss your assessment
One-time audits from $1,500. Payment applies only if a verified, actionable vulnerability is found within scope. See pricing and terms.