Security testing
Find the weak spots
before someone else does.
Penetration testing and vulnerability assessment for websites, web and mobile apps, APIs and internet-facing systems. We attack your software the way a real adversary would — with your written permission — and give you a clear report of what we found and how to fix it.
What we test
Each engagement is scoped to what you actually need. Mix and match, or ask us what makes sense for your system.
Web application testing
Authentication, session handling, access control, injection, cross-site scripting, business-logic flaws and the rest of the OWASP Top 10 — tested by hand, not just scanned.
Mobile app testing
Android app security against OWASP MASVS: insecure data storage, weak transport security, hard-coded secrets, exported components, and the API the app talks to.
API & backend testing
REST and GraphQL APIs, broken object-level authorisation, rate limiting, and backend-as-a-service set-ups such as Supabase and Firebase — including row-level security and storage rules.
External infrastructure
Your internet-facing footprint: exposed services and admin panels, TLS and DNS configuration, email security records, forgotten subdomains and cloud misconfiguration.
Vulnerability assessment
A broader, faster sweep: automated scanning across your systems, with every finding triaged by hand so you get real issues ranked by risk, not a pile of false positives.
Secure code review
A security-focused read of your source code to catch flaws that are hard to see from the outside: secrets in the repo, unsafe input handling and weak cryptography.
Testing approaches
How much you tell us up front changes what the test can show. We'll recommend one when we scope the work.
Black-box
We start with nothing but a URL or an app, just like an outside attacker. Shows what anyone on the internet could find.
Grey-box
We get test accounts for each user role. The most common choice: it covers what a logged-in user, or a stolen account, could do.
White-box
Full access to source code, architecture and configuration. The deepest coverage per hour of testing.
How an engagement works
No surprises: you know exactly what will be tested, when, and how before we send a single request.
Scope
A short call or email exchange to agree the targets, the approach, the testing window and anything that's off limits. You then get a free, fixed written quote.
Authorise
You sign a written authorisation and rules of engagement. We don't touch a system until the person entitled to authorise testing of it has signed.
Test
We test within the agreed window, keep you informed, and stop and tell you straight away if we find something critical.
Report
You get a written report with every finding rated by severity, the evidence, steps to reproduce it and clear guidance on fixing it.
Walk-through
We take your team through the findings and answer questions, so the people fixing the issues understand them.
Retest
Once you've made fixes, we can retest the findings and confirm they're closed. Retesting can be included in your quote.
What's in the report
For management
A plain-language executive summary: overall risk, the issues that matter most, and what to prioritise. No jargon needed to act on it.
For developers
Each finding with a CVSS severity score, affected components, proof-of-concept evidence, reproduction steps and specific remediation advice.
Our testing follows recognised methodologies, including the OWASP Web Security Testing Guide, the OWASP Mobile Application Security Verification Standard (MASVS) and the OWASP API Security Top 10.
How we work
Common questions
How long does a test take?
It depends on the size of the system. A small website or a single mobile app is typically a few days of testing; larger applications with many roles and APIs take longer. You'll get a firm estimate with your quote.
What's the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment finds and ranks as many known weaknesses as possible across your systems. A penetration test goes deeper on a defined target: we try to actually exploit weaknesses and chain them together to show the real-world impact.
Can you test a system we use but don't own?
Only with written permission from whoever owns or operates it. Many hosting and cloud providers allow customers to test their own resources under their published policies; we'll check what applies to your set-up during scoping.
Will testing break anything?
Testing is designed not to disrupt your service, and destructive tests are excluded unless you ask for them. Any active test carries some risk, so we agree a testing window and an emergency contact, and recommend a recent backup.
We've had a breach or think we've been hacked. Can you help?
Email security@alephveclabs.com with “Urgent” in the subject and we'll tell you honestly whether we can help or who you should call.
Found a vulnerability in one of our apps?
We welcome reports from security researchers. Email security@alephveclabs.com with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it publicly, and don't access, change or delete other people's data while investigating.
Ready to find out where you stand?
Tell us what you'd like tested and we'll reply within two business days with questions or a free quote.