REST/GraphQL: auth, scopes, rate limits, mass assignment, injection. Frontends change — the API stays the trust boundary.
Most breaches don’t start at the pretty UI — they start at an endpoint that skipped object ownership checks or returned one field too many. Without an audit you learn that from a customer, a regulator, or post-incident logs. You pay to close holes before production traffic, not to clean up after.
In this engagement:
We start from OpenAPI/Postman, or capture traffic from stage/prod. Critical path first: auth → object-level rights → input/output → limits. Every confirmed finding comes with a PoC request and business/data risk — not CVSS theater. You get a report, fix priorities, and contract-level recommendations. Timeline is set after a short scope review.
Typically we need a spec (OpenAPI/Postman), a test environment, and a role list. Timeline depends on endpoint count and auth depth — we lock it after a short scope review, not a month-long audit for its own sake.
The core deliverable is a prioritized report with PoCs and contract-level recommendations. If you want, SHV can stay for the fix: patch authZ, tighten schemas, rate limits, and re-check critical paths. Audit and remediation can be scoped separately.