Umbra Penance

Services

Penetration testing · Web apps, APIs & SaaS

Penetration testing for web applications, APIs and SaaS.

We test your application the way an attacker would: authentication, authorisation, business logic and tenant isolation. You get evidence your developers can reproduce, fixes they can ship, and engineers who can help implement them.

Describe what needs testing
  • 20 minutes with an engineer
  • No obligation
  • Reply within one working day
  • Led by an ISO 27001 certified Lead Auditor
  • Manual testing, not just a scan
  • Retest of agreed fixes included
Example: how a test runsexample
  • Scope & authorisation signedpass
  • Authentication & sessionspass
  • Access to other users' records (BOLA) · APIfixed + retested
  • Tenant isolation across accountspass
  • Business-logic abuse casesin review
  • Report · walkthrough · retestin review
Critical findings are raised during testing, not held for the report.

You’ll speak with Adel, the ISO 27001 Lead Auditor who runs every test.

Project

Security we designed into a live SaaS.

Client: Amadoo, a nursery-management SaaS platform with a mobile app for parents and staff

Nursery SaaS · web + mobile app

Tenant isolation and role-based access, designed into the platform before the first feature.

Tenant isolation
Tenant isolation enforced in PostgreSQL with row-level security across 20+ tables, so one nursery can never read another's data.
Permissions
Role-based permissions for admins, managers, practitioners and parents, mapped to 12 distinct staff positions.
Access
Authentication and data access built on least-privilege principles, designed in from the first migration rather than retrofitted.
“I would absolutely recommend Adel to any founder or business looking for a reliable technical partner.”
Ahmad Shawky, Founder, Amadoo
Read the full project

When you need a penetration test

The strongest engagements start with a business reason and a deadline, not a vague instruction to "check security".

  • An enterprise prospect has sent a security questionnaire and asks for a recent pentest.
  • You're launching a product and real customer data is about to arrive.
  • You're preparing for ISO 27001 or SOC 2 and need evidence for your risk treatment.
  • A new API, login provider, mobile app or user role has changed your attack surface.
  • Your SaaS holds several customers' data and nobody has tested whether one can see another's.
Two people reviewing code on large monitors

Manual testing

A person trying to break it, not just a scanner.

Scanners find known patterns. Real issues hide in permissions, business logic and the way features interact, and finding them takes someone reading the application the way an attacker would.

What we test

  • Web application penetration testing

    Authenticated user journeys, admin functions, sessions, file handling and business logic, tested manually beyond what a scanner finds.

  • API penetration testing

    REST and GraphQL APIs tested for broken authorisation, excessive data exposure, injection, rate-limit weaknesses and abuse of intended functionality.

  • SaaS & multi-tenant testing

    Tenant isolation, role boundaries, invitations, support tooling and privilege changes: the flows that expose one customer's data to another.

  • Automation & AI workflow review

    n8n and Make instances, webhooks, API keys and AI agents reviewed for exposed credentials, unauthenticated triggers and prompt-injection paths.

Testers who can also fix what they find.

Pure security firms hand you a report. We design and build software too, so recommendations account for your codebase, release pressure and engineering trade-offs, and we can help implement them.

  • Findings written for developers, not just auditors.
  • Remediation support available from the same team.
  • Experience designing tenant isolation and RBAC on production SaaS.

Engagements and pricing

Typical engagements

Effort depends on roles, functionality and API surface. We confirm it after a short scoping call, with a fixed price.

  • Focused web app or API test

    One application or API, authenticated testing across agreed roles, report, walkthrough and retest.

    Best for: Pre-launch checks and enterprise questionnaires.

  • SaaS platform assessment

    Web app plus API plus multi-tenant isolation testing across tenants and roles.

    Best for: B2B SaaS holding several customers' data.

  • Secure build review

    Architecture and code-level review during development, with a penetration test before launch.

    Best for: Teams building something new and wanting security built in.

How pricing works: a free 20-minute call, then a written scope with a fixed price, then you decide. No day-rate surprises.

How we work

Methodology

Clear scope, manual validation and a direct route from confirmed finding to verified fix.

  1. Scope & authorise

    Targets, roles, test accounts, exclusions and safeguards agreed in writing. A short threat-model session identifies what an attacker would value most.

  2. Test manually

    Tooling supports coverage; judgement finds the real issues. Testing aligned to the OWASP Web Security Testing Guide and API Security Top 10.

  3. Validate impact

    False positives removed. Each finding shows evidence, business impact and how it was exploited.

  4. Report & walk through

    Executive summary for leadership, technical detail for developers, and a call to walk through the fixes.

  5. Retest

    Agreed fixes verified, so you can show customers and auditors that issues were closed.

What you receive

  • Written scope, rules of engagement and authorisation before testing starts.
  • Executive summary in plain English for leadership and customers.
  • Prioritised findings with evidence, affected assets, impact and reproduction steps.
  • Practical remediation guidance written by engineers who build software.
  • Developer walkthrough call, and hands-on remediation support if you want it.
  • Retest of agreed fixes, with an updated status for each finding.
  • Confidential handling of all data and findings; NDA on request.

Questions we get asked

How is a penetration test priced?
Fixed price, based on the roles, functionality and API surface in scope, confirmed after a short scoping call. Retest of agreed fixes is included.
How long does a web application penetration test take?
A focused web application or API assessment often takes several testing days, followed by reporting and a walkthrough. Duration depends on user roles, functionality, API surface and the agreed depth. We confirm effort after a short scoping call.
What's the difference between a vulnerability scan and a penetration test?
A scanner checks for known technical patterns at scale. A penetration test adds manual investigation of authenticated workflows, access controls and business logic, and validates whether a weakness is genuinely exploitable and what it means for the business.
Do you test production systems?
Only with written authorisation, agreed exclusions, safe test data and communication procedures. Where production risk is too high, we use a representative staging environment and confirm the important differences.
What does the report include?
Scope and methodology, an executive summary, prioritised findings with evidence, affected assets, business and technical impact, reproduction steps and remediation guidance. Critical issues are raised during testing rather than held for the report.
Are you CREST accredited?
Umbra Penance is not a CREST-accredited company. If your contract, insurer or framework specifically requires CREST or CHECK, tell us and we'll say so upfront. For most application, API and SaaS testing, buyers need a credible methodology, a clear report and fixes verified, and that's what we deliver.
Can you help our developers fix the findings?
Yes. That's the difference with us. Every engagement includes a walkthrough, and we can support implementation directly. Retesting verifies the fixes close the issue without introducing a new one.

Tell us what needs testing, and by when.

Send us the application, the user roles and your deadline. We'll turn them into a clear scope and a fixed quote.

Describe what needs testing
  • Pick a time in the next step
  • Free, no obligation
  • 20 minutes on Google Meet