ceronWeb application security audit
Find out whether your customer portal protects the accounts, records, and business actions behind the login.
Can one customer reach another customer’s data?
For SaaS teams, customer portals, and business applications preparing for launch, changing account permissions, or responding to a customer’s security review.
- The boundary we assess
- The application’s users, roles, tenants, and business rules.
- What to prepare
- Application URLs, test accounts for the agreed roles, two synthetic tenants where relevant, and a short description of important workflows.
What the assessment can cover
These areas guide scoping. The agreed asset inventory, methods, and access determine which tests are included in your engagement.
Authentication and recovery
Review sign-in, password reset, invitation, and session behavior. Check what happens after an account loses access, not only when a login succeeds.
Tenant and role boundaries
Compare permitted and denied actions across synthetic accounts. Include direct record requests, bulk actions, downloads, and privileged fields where they are in scope.
Business workflows
Examine the agreed paths for uploads, exports, billing, and administrative actions. Record the expected business rule before evaluating whether the application enforces it.
Browser and server exposure
Review relevant browser protections and input handling alongside the application context. A missing header alone is not evidence of account takeover.
From a test to a useful finding
Ceron uses AI-assisted investigation and checks potential findings against evidence. Your report connects the affected asset, observed behavior, business impact, and recommended fix.
What the evidence should explain
- A member in test tenant A requests a synthetic invoice owned by tenant B.
- The evidence records the test identity, affected route, expected access rule, observed response, and business impact. If access is denied, that result is documented too.
- Engineering receives a specific authorization boundary to fix and a repeatable case to use when checking the repair.
A public URL check cannot evaluate authenticated roles or tenant isolation. Coverage depends on the accounts, workflows, environments, and testing methods agreed before the audit.
This example explains the method; it is not a customer result. Read about the Ceron Agent Harness.
Plan the review with your team
Use these guides to turn a broad concern into testable questions before your scoping call.
Use the 18-case tenant isolation worksheet →Before you book
Is this the same as a website security scan?
The free checker inspects a public response. An authorized web application audit can investigate accounts, permissions, and business workflows using the access you provide. Scope is agreed before testing.
Does the audit include penetration testing?
Deeper exploitation and attack-path testing belong in an explicitly agreed penetration-testing scope. Ceron’s Extended audit supports that work; a basic audit does not automatically authorize every testing method.
What should we prepare?
Provide an asset owner, the application URLs, relevant roles and test identities, synthetic records, and the workflows that matter most. Agree on exclusions, traffic limits, and a stop contact before testing starts.
Start with the boundary that matters.
Bring the systems you want reviewed and the decision you need to make. We agree on assets, access, testing methods, timing, and a fixed fee before work begins.
One-time audits from $1,500. Payment applies only if a verified, actionable vulnerability is found within scope. See pricing and terms.