Skip to content
Unmesha Technologies, security assessments

Is your platform’s design safe to keep building on?

Your engineers walk us through how the whole platform fits together. We tell you which design changes to make first.

Request a free callWhat you get

Free 30-minute call.

A typical SaaS product. An architecture assessment looks at how every part connects.

A webhook setting that reaches inside your network

A fictional example of what can go wrong here. The same problem appears as ARC-02 in our sample report.

  1. A customer adds a webhook

    Your app lets each customer give a web address for event notifications.

  2. The address points inside

    Instead of their own server, they enter an address inside your network.

  3. Your server makes the call

    The request now comes from inside, where your internal services trust it.

  4. Internal services answer

    A customer can reach services that were never meant to face the internet.

So we ask: Can an address a customer gives you make your platform call something inside your own network?

For your engineer

webhooks/deliver.ts

export async function deliver(event, subscription) {
  const body = JSON.stringify(event);
  // The address is whatever the customer saved.
  await fetch(subscription.url, { method: "POST", body });
}

What we check

The questions we start from. We agree the final list with you on the call.

Best done before a big redesign or a large integration, while changes are still cheap.

  • Who and what can sign in, and what is each one allowed to do?
  • Is each customer’s data kept apart everywhere, including background jobs and exports?
  • Where do your keys and passwords live, and who can use them?
  • If one part were broken into, how far could it reach, and would you notice?

What you get, and what it costs

A report with the evidence for each issue, what to fix first, and one round of retesting. See what a report looks like.

Included

  • The assessment of the systems we agree
  • A findings report with the evidence for each issue
  • What to fix first, and how to check each fix
  • A walkthrough call with your engineers
  • One round of retesting after your fixes
  • The threat model we build with your team, for you to keep up to date

Before you enquire

What people ask us most. Wondering whether a pentest would do? Is a VAPT enough?

What do you need from us?

Your architecture diagrams, current or planned, and a working session with your engineers. Please leave sensitive diagrams out of a first enquiry.

Where do you stop?

We review the design and what you show us. Checking that the live system matches it is a separate test.

Is this a penetration test?

No. We review how the platform is designed. If you want us to test hands-on as well, we’ll put that in the scope.

Is retesting included?

Yes, one round. Once your team has made the fixes, we retest them. Each finding also comes with a check your team can run themselves.

How do you handle confidential material?

Send an outline first and leave out passwords and customer data. We only ask for anything sensitive once we’ve agreed the scope and a safe way to share it.

Planning a redesign? Bring it to us before the tickets are written

What are you changing, and when do the design decisions need to be made?

What happens next

  1. We reply within one working day. We set up the call, and you meet the people who’d do the work.
  2. We send a proposal with the scope, the timing and a fixed fee.
  3. Work starts when you say go.

Sending an enquiry doesn’t commit you to anything. About the team

Request a free call

Send a short outline of what you want checked and any deadline.

Email Unmesha

Please leave out passwords and customer data. How we handle enquiry information.