# Penetration testing services for web apps, APIs and SaaS Source: https://penetrationtestservices.com/ Publisher: Excession Labs (penetrationtestservices.com) Last updated: 2026-11-09 Authorized penetration testing of web applications, APIs and multi-tenant SaaS by Excession Labs. Evidence for every finding, fixes and a retest. Penetration testing by Excession Labs Penetration tests that prove every finding We test web applications, APIs and multi-tenant SaaS platforms. Every finding in our report shows the request and response that prove it, what an attacker gains, and the fix. Request a testSee the sample report Testing starts only after a written scope and written authorization from the system owner. Demonstration F-01 · Harbor Notes (demo app)Critical Any signed-in user can export another workspace's notes Assetapi.harbor-notes.exampleEvidenceObserved, read back from tenant BStatusOpen GET /v1/workspaces/ws_test_B/export Authorization: Bearer <tenant A member> → 200 OK · 41 notes · owner: ws_test_B # control: nonexistent workspace GET /v1/workspaces/ws_test_ZZ/export → 404 Not Found Fix: check in the export handler that the caller belongs to the workspace. A check in the UI does not protect the API. Each finding also has reproduction steps and a retest resultOpen the sample report What we testApplications your customers sign in to. Most of our time goes into access control: whether one user can read or change another user's data, and what the API accepts without checking. Web applicationsAccess control, sessions and business logicRoles, sharing, invitations, uploads, payments and admin paths. Web app testing APIsREST and GraphQL, documented or notObject-level authorization, mass assignment, rate limits and data exposure. API testing Multi-tenant SaaSOne customer must never reach anotherTwo test tenants, every object type, every export and search path. SaaS testing No-code and AI-built appsBubble, Supabase, Firebase and fast-built appsPrivacy rules, row-level security, exposed keys and workflow endpoints. Platform testing Before launchTest the release before customers doFind the exploitable issues while fixing them is still cheap. Pre-launch testing For a customer reviewEvidence for an enterprise dealA report your buyer's security team can read, with fixes verified. Customer security reviews Building with LLMs or agents? Those need a different test: AI application security assessments. We report a finding only when we can show its effectIf an API answers "200 OK" to a request that should fail, we still have to prove that something happened. We read the changed record back through a second account, show a cross-site attack working in a real browser, or show the exposed data from a test-owned record.Each attack also runs with controls: a nonexistent ID, the wrong record type, an unsigned token and an anonymous caller. If a control shows the first result was misleading, the issue does not go in the report as confirmed.Read our methodology ObserveTenant A's token requests tenant B's export. The API returns 200 and 41 notes. ControlSame request for a workspace that does not exist returns 404, so the 200 is not a generic response. Read backTenant B's own session lists the same 41 note IDs. The data really belongs to tenant B. BoundOnly test-owned workspaces were used. No real customer data was read. VerdictConfirmed. Rated Critical, with a fix and a retest step. (Demonstration example.) What every test includes A written scope and rules of engagement that you approve An executive summary with the few actions that matter most For each finding: description, impact, verified results, reproduction steps and a fix Controls that held, so fixes do not break working protections A remediation plan and a list of limitations and open questions Evidence files and reproduction scripts, in HTML, PDF and Markdown A retest of fixed findings, agreed in the scope Open the sample report How a test runs Short callWhat triggered the test, who will read the report, and your deadline. Written scope and authorizationHosts, roles, test windows, off-limits actions and contacts. The system owner signs. TestingAgainst the agreed rules, with bounded tests and test-owned data. ReportEvery finding with evidence, reproduction and a fix. Fix and retestWe verify your fixes and record the result. Who does the workExcession Labs builds Incursion, an AI agent for authorized security testing. It splits an engagement into tasks and runs them in parallel. Each tool runs on its own, waits for approval, or is blocked, by rules we set for your scope.Incursion runs the repetitive checks across every role and endpoint. Excession Labs agrees the scope with you, checks the evidence for each finding and writes the report.About Excession Labs · How AI-assisted testing works Free pilot on a small scopeFor a small number of teams with a real application and a reason to use the result, we run a free pilot. The scope is small and written down. You get every finding in that scope, with evidence and fix guidance, at no cost.Apply for a pilotPricing and scope Guides for planning and using a pentest Pentest basicsWhat is penetration testing?What a test is, what it produces and how it differs from a scan. Planning a pentestHow to prepare for a penetration testAccounts, data, environments and contacts to set up before day one. Compliance and evidenceDoes SOC 2 require a penetration test?What the criteria say, and what auditors and customers usually ask for. API testingIDOR testingHow testers prove broken object-level authorization with two accounts. SaaS testingMulti-tenant isolation testingA two-tenant test matrix for objects, search, exports and files. After the pentestHow to read a pentest reportSeverity, evidence, reproduction and how to plan the fixes. All guides ## Questions ### What does a penetration test from Excession Labs cover? Web applications, APIs (REST and GraphQL) and multi-tenant SaaS platforms. We agree the exact hosts, roles and actions in a written scope before testing. AI features such as chat assistants and agents are assessed separately through [airedteamingservices.com](https://airedteamingservices.com/). ### How much does a penetration test cost? We quote after a short scoping call, because the price depends on the number of applications, user roles, API endpoints and environments, and on your deadline. See [pricing and scope](/pricing/) for what changes a quote. Small teams can [apply for a free pilot](/free-pentest/). ### Do you test production? We prefer a staging environment with realistic data. If production is the only option, we agree limits in writing first: no destructive actions on real data, bounded tests of email, uploads and paid third-party services, and a contact who can stop testing at any time. ### Will our auditor or customer accept the report? Nobody can promise that. What we can do is ask what the reviewer needs during scoping, and write a report that shows scope, method, evidence and fixes clearly. Check the [sample report](/sample-report/) and share it with the reviewer before you buy. ### Do you use AI to test? Yes. We use Incursion, the Excession Labs testing agent, to run test tasks in parallel under tool rules we set. Excession Labs checks the evidence for each finding and writes the report. [How AI-assisted testing works](https://aipentestservices.com/how-it-works/).