Decision summary
What was assessed, what matters, and the recommended next action.
DVNLL Focused Security Assessment
One agreed workflow.
Verified permissions.
A report you can act on.
Your SaaS application handles paying business customers across multiple roles. Can someone access another customer's data, or perform actions their role should not allow? I test one agreed workflow, explain what I can verify, and check the fixes.
Scope
What is assessed
| Element | Detail |
|---|---|
| Scope | One agreed workflow in one web application, including its supporting API requests |
| Example | Invite a colleague → assign a role → access, share or export customer documents |
| Access | Agreed test environment, accounts for relevant roles, and two test organisations where tenant separation matters |
| Testing | Manual testing with tools — access controls, session behaviour and workflow abuse |
| Deliverable | Concise report, reproducible evidence, prioritised fixes and a developer walkthrough |
| Retest | One verification round within 30 days of report delivery |
| Commercial | One-off fixed fee after a short scoping call |
Deliverables
What you receive
Coverage table
Functions, roles and boundaries tested — including limitations and what was not tested.
Verified findings
Reproduction steps, evidence, business impact and remediation guidance for each finding.
Retest update
Fixed, partially fixed, unresolved or unable to verify — with evidence for each status.
Developer walkthrough
A 30-minute session with whoever will implement the fixes, to make the report easier to act on.
Boundaries
What is explicitly excluded
Whole-application assessment, infrastructure review, denial-of-service testing and third-party systems — unless separately scoped and agreed. The report shows tested, untested and blocked areas. A result with no verified vulnerabilities still includes useful evidence of coverage; it does not establish that the application is secure.
Commercial
Fixed price after scoping
The assessment is designed around three working days of effort. The fee is agreed before work starts — no subscription, no recurring obligation.
- ½ daySetup, scoping and workflow mapping
- 1½ daysTesting
- 1 dayReporting, developer walkthrough and retest (reserved)
Ready to scope?
Describe the workflow you want tested.
A short call is enough to agree scope, access requirements and a fixed fee.