Broken object-level authorisation (BOLA/IDOR)
Systematic checks that no user or tenant can read or change data belonging to another.
EthicsComputer Assistant
Online • Fast Response
REST, GraphQL & Mobile APIs
APIs expose your data and business logic directly, and many serious breaches start there. We test every endpoint for broken authorisation, excessive data exposure, weak authentication and abuse, following the OWASP API Security Top 10.
What this covers
Typical timeline
Most assessments take 5–15 working days; critical findings are reported within 24 hours.
Who it is for
We work from your API documentation, Postman collections or traffic captured from your apps, then test each role and tenant boundary by hand. Findings include working requests you can replay, so your developers can reproduce and fix issues quickly.
Discuss your requirementFintech, lending and payment platforms exposing partner APIs
SaaS products with public or customer-facing APIs
Mobile app companies whose backend APIs power the app
Enterprises integrating many third-party services
Capabilities
Systematic checks that no user or tenant can read or change data belonging to another.
JWT, OAuth 2.0 and API key handling, token expiry, refresh flows and signature validation.
Brute force, enumeration, OTP abuse and resource exhaustion checks on sensitive endpoints.
Responses that return more data than needed and requests that update fields they should not.
Introspection, query depth, batching attacks and webhook signature verification.
A free retest after fixes plus a checklist your team can apply to new endpoints.
How we work
You always know what happens next, who is responsible and what you will receive at each stage.
Typical timeline
Most assessments take 5–15 working days; critical findings are reported within 24 hours.
Assets, roles, test windows and rules of engagement are agreed in writing.
We map the attack surface: endpoints, parameters, integrations and exposed services.
Hands-on exploitation of logic, access control and injection flaws, backed by tooling.
CVSS-scored findings with proof, business impact and step-by-step fixes.
Fixes are verified and a closure report is issued for auditors and clients.
Deliverables
Methodology & tools
We recommend tools based on your scale, budget and existing systems, not on what is fashionable. Every choice is explained in the proposal.
Engagement models
A scoped test with a severity-rated report, developer walkthrough and one free retest after you fix the findings.
Gap assessment, policy and control implementation, evidence collection and audit support across a fixed timeline.
Quarterly testing, release-based retests and on-call advisory for teams that ship often.
How pricing works: Security work is priced on scope: number of applications, APIs, user roles, IPs or cloud accounts. You get a fixed quote after a short scoping call. Company audits start at ₹25,000.
Get a quoteFAQs
API documentation such as an OpenAPI or Swagger file or a Postman collection, a test environment URL and test accounts for each role. If documentation is missing, we can map the API from your web or mobile app traffic.
Broken object-level authorisation happens when an API returns or changes a record simply because the requester supplied its ID, without checking ownership. It is easy to miss and often exposes other customers' data, which is why we test it on every endpoint.
Yes. We test GraphQL-specific risks such as introspection exposure, deeply nested or batched queries, field-level authorisation and injection through resolvers.
We test how your system uses them: secrets handling, webhook verification and trust assumptions. Testing a provider's own infrastructure requires that provider's permission.
Keep exploring
Manual-first web application penetration testing: OWASP Top 10, SQL injection, XSS, CSRF, access control and…
ExploreAndroid and iOS app penetration testing based on OWASP MASVS: insecure storage, weak crypto, API flaws…
ExploreSecure fintech platforms and APIs: lending, payments, wallets and KYC integrations, built with audit trails…
ExploreREST and GraphQL APIs, mobile app backends and integrations between ERP, CRM, Tally, payment gateways and…
ExploreOn-site meetings across Delhi NCR and Haryana from our Rohtak office; remote delivery across India.
Reply within one business day
Share a few details. A senior specialist reviews them and schedules a call to discuss scope, timeline and cost, with no obligation.
Receive a preliminary project architecture, pricing tiers, and timeline estimate within 24 hours under strict NDA.