Alvo Web application & API security testing

Look for the flaws before someone else does.

We're a security agency for teams that ship software. We test your web apps and APIs by hand, review the code behind them, and give you a report your engineers can act on, delivered through a private client portal rather than as an email attachment.

Email us for a quote Explore services
  • Fixed-fee quotes
  • Retest included
  • OWASP & CVSS v4.0 aligned
  • Reports through an encrypted portal

The Alvo client portal. Sample data: Northwind Labs is a fictional company.

What we do

Security testing for the software you ship.

Six services, one standard: every finding is reproduced by a person, explained in plain language, and comes with a fix your team can act on.

01

Web application penetration testing

Manual testing of your app the way an attacker would approach it: authentication, access control, tenant isolation, injection and business logic.

  • OWASP WSTG
  • ASVS
  • SOC 2 evidence
Learn more 02

API security testing

REST and GraphQL APIs tested against the OWASP API Security Top 10, with object-level authorisation as the first priority.

  • REST
  • GraphQL
  • API Top 10
Learn more 03

Source code review

Security-focused review of the code paths that matter: authentication, authorisation, cryptography, input handling and secrets. Findings come with file and line references.

  • Manual review
  • Dependencies
  • Secrets
Learn more 04

Security audits

Architecture, configuration and process review against ASVS or your compliance framework, ending in a prioritised roadmap rather than a list of 200 items.

  • Architecture
  • Gap analysis
  • Roadmap
Learn more 05

Cloud & infrastructure review

Configuration review of the AWS, GCP or Azure accounts behind your app: identity and access, network exposure, storage, logging, TLS and DNS.

  • AWS · GCP · Azure
  • CIS benchmarks
Learn more 06

Retesting & attestation

We verify your fixes, update each finding's status, and issue an attestation letter you can share with customers and auditors.

  • Fix verification
  • Attestation letter
Learn more

How an engagement runs

Five steps, no surprises.

You'll always know where your test is: every stage shows up live in your client portal.

  1. Scope

    A short call, then a written scope and a fixed-fee quote. Targets, test accounts, environments and dates, all agreed up front.

  2. Authorise

    Signed rules of engagement before any testing starts: what's in scope, what's off-limits, testing windows and an emergency contact.

  3. Test

    Manual-first testing inside the agreed window. Anything critical is reported to you the same day, not saved for the final report.

  4. Report

    What was tested and the limits of the test, then every finding with impact, reproduction steps, evidence and a concrete fix. Delivered to your encrypted Report Vault, plus a readout call.

  5. Retest

    Once you've made your fixes, we verify each one and update its status. You get a retest report and an attestation letter.

What a finding looks like

Not a scanner dump.
Each finding, ready to fix.

Impact in plain language

What an attacker could actually do, who it affects, and why the severity is what it is.

Evidence you can check

Requests, responses and the exact steps to reproduce, so your engineers can confirm it themselves.

A fix, not a link to a CWE page

Specific remediation for your stack, then a retest to confirm it holds.

ALV-NW-004 High CVSS v4.0 · 8.7 Illustrative example · fictional app

Any customer can read other organisations' invoices by changing an ID

Affected

GET/api/v2/invoices/{invoiceId}

What we found

The endpoint checks that the caller is signed in, but not that the invoice belongs to the caller's organisation. Invoice IDs are sequential, so every invoice in the system can be reached.

Impact

Cross-tenant disclosure of billing addresses, line items and amounts for every customer. Discovered with two ordinary test accounts and no special access.

Recommended fix

Scope the lookup by the caller's organisation on the server, return 404 when it doesn't match, and add a regression test that requests another tenant's invoice. Switching to non-sequential IDs is defence in depth, not a fix.

Evidence: 2 request/response pairs · 2 test accounts · timestamps ✓ Fixed, verified in retest

Our own security

Your report is a map of your weak spots.
We treat it like one.

A security agency is a higher-value target than any single client. So we keep as little as possible, encrypt what we keep, and show you every time it's accessed.

Private client portal

Reports never travel as email attachments. You sign in with a Client-ID that's 120 bits of randomness, shown once and stored only as a keyed hash.

Encrypted at rest

Every report is encrypted with its own AES-256-GCM key, which is itself encrypted with a master key kept apart from the files.

Every access is visible

Sign-ins and downloads are logged and shown to you in the portal, so you'd notice a sign-in that wasn't yours.

Nothing third-party

No analytics, trackers, chat widgets or external scripts, on this site or in the portal. A strict Content Security Policy enforces it.

Minimum data, then deleted

We access only what's needed to prove impact. Source code and test data are deleted at the end of the engagement under a written retention policy.

Checkable downloads

The portal shows a SHA-256 checksum for every report, so you can confirm the file you have is exactly the one we delivered.

How we handle your data

Questions

The things people ask first.

How much does a test cost?

Every engagement is a fixed fee, quoted after a short scoping conversation. The price depends on the size and complexity of what's being tested (user roles, pages, API endpoints, integrations), never on your headcount. Email contact@alvo.team and we'll come back with questions or a number.

How long does it take?

A typical web application or API test is one to two weeks of testing, with the report a few business days later. Source code reviews depend on the size of the codebase. You'll get dates in the proposal, and the portal shows where things stand throughout.

What if you don't find anything?

It can happen, and it's a real result, not a failed test. No honest tester can promise to find vulnerabilities, or a particular number or severity of them, so we don't. The fixed fee pays for the testing and the report, whatever the outcome, and the report still sets out what was tested, how, which controls held up, and the limits of the test. The reverse holds too: few or no findings doesn't prove a system is free of vulnerabilities, only that none were identified within the scope and time available. More on this.

Will testing break our production environment?

We agree rules of engagement before starting: exact targets, testing windows, what's off-limits, and who to call if something looks wrong. We prefer a staging environment that mirrors production. When production is in scope, we don't run denial-of-service, volumetric or destructive tests unless you've explicitly approved them in writing.

Do you need our source code?

Not for a penetration test, though a short architecture walkthrough helps. For a source code review, yes: shared read-only, used only for the engagement, and deleted at the end.

Which standards do you follow?

OWASP WSTG and ASVS for web applications, the OWASP API Security Top 10 for APIs, and CVSS v4.0 for severity. Findings are mapped to these references so they slot straight into SOC 2 and ISO 27001 evidence.

Can we get something to show our customers?

Yes. After a retest we can issue an attestation letter covering scope, dates and outcome, without disclosing the details of any finding. It records what was tested and what we verified; it doesn't certify that a system is secure.

Do you sign NDAs?

Yes. We're happy to sign a mutual NDA before you share any scoping detail.

Tell us what you're shipping.

A few details about the system and your timeline is all we need to come back with scoping questions or a fixed-fee proposal.

Email us for a quote How we work

Request a quote

Email us and we'll come back with scoping questions or a fixed-fee proposal.

Write to

contact@alvo.team

Open in your email app

Worth including

  • Company and website
  • What needs testingWeb app, API, source code, cloud, or a retest.
  • When you need itA date, a launch, or an audit window.
  • BudgetOptional, but it helps us scope to it.
  • What's prompting itCompliance, a customer asking, a recent incident.

Already a client? Write to support@alvo.team. Found a vulnerability in our systems? security@alvo.team.