SaaS security notes for founders and CTOs

What we’d check first, and what to ask any provider. For founders and the engineers who do the work.

Free 30-minute scoping call. We reply within one working day.

API authorisation: where one customer sees another’s data

Permission checks tend to hold on the main screens and slip on the export or the overnight job.

Architecture review or penetration test first?
The answer depends less on your product than on what is about to change in it.
Cloud security assessment: agree access before anyone logs in
What to agree about accounts and access before a cloud assessment starts, so the report covers what you think it covers.
CI/CD security: who can ship to production unseen?
Pipeline risk often comes down to an account or key that can reach production without a second person seeing the change.
Prompt injection testing for RAG and AI agents
What to test in an AI feature that reads customer documents or calls tools, and what to ask whoever tests it.
Microsoft 365 and Google Workspace: start with the admins
The questions we’d put to whoever runs your admin console, starting with who holds admin rights.
Closing VAPT findings before the retest
Short answers to the questions owners ask in the weeks between a VAPT report and the retest.

Tell us what’s changing in your product. On a free 30-minute scoping call we’ll suggest what to check first.