I will test your rest API security and provide a remediation report

Want to know whether your REST API lets one user read another user's data, or accepts input it shouldn't? I test APIs you own or are authorized to test, and deliver a report your developers can act on.

What I check (depending on the package):

Authentication and token handling

Object-level and function-level authorization (BOLA/IDOR)

Excessive data exposure and writable properties (mass assignment)

Input validation and injection

Security-relevant configuration, e.g. CORS, headers and error handling

These are areas I test, not guaranteed findings.

The Basic package is an automated scan with manual confirmation of the results. Standard and Premium are manual testing.

Every report includes scope and coverage, verified findings with request/response evidence, risk ratings, remediation steps and limitations. Scanner output I couldn't confirm is labelled as unverified.

Scope is counted in endpoints (method + path, e.g. GET /users/{id}) and user roles. Please use a staging or test environment and test accounts. Don't send production passwords in chat.

Not included unless agreed: GraphQL, finding undocumented endpoints, load/DoS testing, fixing code, retesting after fixes.