Built around your environment.
Blackcube Solutions assesses agreed web applications and API endpoints for Australian businesses. Engagements can focus on customer portals, internal tools or particular workflows. We tailor testing to your application's user roles, data and business logic, with particular attention to how it handles client information.
What we assess.
The specific checks depend on your systems and the agreed scope. Areas we can discuss include:
Authentication and sessions
Examine agreed login, session and account recovery flows, including how an application maintains and ends access.
User roles and permissions
Review whether different account roles can reach records, functions or API endpoints beyond their intended permissions.
Application logic
Assess selected workflows for unexpected sequences, missing checks and opportunities to misuse a legitimate function.
API access and input handling
Review agreed endpoints, the way requests are validated, and the information returned to different callers.
When this assessment can help.
- Before releasing a customer portal or a substantial change to authentication, permissions or business workflows.
- When different user roles or customer organisations share an application and you need to examine their access boundaries.
- When an API exposes business functions or sensitive records and you want targeted assessment beyond the public website.
Clear scope. Useful conclusions.
Application and API testing concentrates on the selected workflows, account roles and endpoints, rather than assuming every page or integration is covered. We agree on whether browser-facing functions, APIs or both are in scope. Third-party identity providers, payment systems, source code review and infrastructure testing require explicit discussion and appropriate permission.
Before testing begins.
Provide an overview of the application, its important workflows and the roles users can hold. We agree on the endpoints and functions to assess, test accounts, data handling arrangements and exclusions. A representative test environment can be discussed where it suits the engagement.
Findings you can work with.
Findings explain the affected behaviour and potential business impact, with remediation guidance that your developers can work through. The report helps distinguish individual defects from patterns in the application’s access controls or workflows. Any retesting is agreed after remediation needs are understood.
From findings to improvements.
Your developers can use the findings to investigate affected access checks, input handling or workflows. Discuss whether similar functions share the same pattern before choosing a fix. Retesting can revisit agreed findings after changes are deployed to the agreed environment. New roles, endpoints or major workflow changes may need additional assessment.
Common questions.
Do you need application source code?
That depends on the assessment. The starting point is an agreed application scope, suitable access and information about the relevant workflows. Any source code review must be agreed separately.
Can APIs be assessed without the full application?
An API-focused assessment can be discussed where you can provide endpoint information, suitable test accounts and permission. Dependencies and excluded systems are established before testing.