Web Application Penetration Testing
Test authentication, sessions, access control, input validation, business logic and common web vulnerabilities with reproducible evidence and practical remediation steps.
Web pentest
Penetration Testing & Application Security
Understand where your application could expose data or allow unwanted access. NordCodex tests websites, APIs that connect systems, mobile and desktop apps, cloud services and AI products. We agree the scope first, document what we find and explain how to fix it.
Web · API · Mobile · Desktop · AI/LLM · Vibe-coded apps
Security testing for the software businesses actually ship
Each engagement is limited to assets you own or are explicitly authorized to test. We combine automated coverage with targeted manual validation where it adds evidence and business context.
Vibe-Coded App Security & Release Review
Independent review of products built with tools such as Lovable, Cursor, Claude Code, Codex, Replit, Bolt or similar AI coding workflows — covering web, mobile and desktop releases before production.
AI-generated code
API Security Testing
Assess APIs for broken object authorization, authentication weaknesses, excessive data exposure, injection, rate-limit gaps and unsafe backend behavior.
REST · GraphQL
Mobile App Security Testing
Review mobile packages, local storage, API communication, authentication flows, deep links and runtime behavior within an explicitly authorized scope.
iOS · Android
Desktop Application Security Review
Review desktop software for unsafe local storage, secrets, update mechanisms, IPC or local API exposure, packaging risks, permissions and backend trust assumptions.
Windows · macOS
AI, LLM & RAG Security Testing
Evaluate AI-enabled products for prompt injection, unsafe tool use, sensitive-data leakage, retrieval-boundary failures, authorization gaps and insecure agent integrations.
AI security
Cloud, Configuration & Pre-Launch Security Review
Review deployment configuration, identity boundaries, secrets handling, exposed services and architecture before launch or a major production change.
Release readiness
Security review of apps built with AI (vibe coding)
Software built with AI still needs an independent security review. We review AI-generated and AI-assisted code, including applications built through vibe coding, and test the running product when authorized. The review focuses on access, data and the risks of releasing the application.
- Web & SaaS
- iOS & Android
- Windows & macOS
- APIs & Supabase/Firebase
- AI agents & RAG
Authentication & authorization
Check login flows, role enforcement, object ownership, admin boundaries, RLS/database policies and client-side trust assumptions.
Secrets & sensitive data
Look for exposed API keys, tokens, credentials, unsafe logs, browser/mobile storage and secrets accidentally committed to repositories.
Dependencies & supply chain
Review AI-suggested packages, outdated or vulnerable dependencies, hallucinated package risk and build/install scripts that execute with trusted permissions.
API & data-layer security
Test endpoints, database policies, input validation, mass assignment, rate limiting, file handling, CORS and backend authorization.
Desktop/mobile release risks
Review packaging, update paths, local files, deep links, local IPC or services, permissions and assumptions that differ from browser-only applications.
Tests, CI/CD & release confidence
Check whether tests actually prove security-critical behavior, whether assertions were weakened, and whether AI changed CI/CD, deployment or build files in risky ways.
Authorized testing with controlled impact
A useful security test should prove risk without creating unnecessary production risk. We define the targets, identities, permissions, rate limits, prohibited actions and cleanup expectations before active testing begins.
Owned or authorized assets only
Discovered third-party systems are classified but not actively tested unless the scope explicitly authorizes them.
Agreed limits for production testing
Availability-impacting, destructive or data-changing techniques require explicit approval and appropriate safeguards.
Proof over scanner noise
We separate confirmed findings, observations and unverified hypotheses so the report is clear about what was actually demonstrated.
Developer-ready remediation
Findings explain the affected flow, evidence, likely impact and a practical remediation path for engineering teams.
Vulnerability scan vs. penetration test
Vulnerability scan
Broad automated coverage that identifies potential weaknesses quickly. Useful for discovery and recurring hygiene, but a scanner result alone may not prove exploitability or business impact.
Penetration test
A scoped security assessment that validates selected weaknesses, attack paths and business logic and produces stronger evidence for prioritization and remediation.
A security report with clear priorities and next steps
- Executive summary with the most important risks and business context
- Technical findings with affected assets, evidence and reproduction detail where safe
- Prioritization based on exploitability and likely impact
- Actionable remediation guidance for developers and system owners
- Clear separation between confirmed findings, observations and unverified hypotheses
- Optional retest scope to verify important fixes
Cybersecurity assessment questions
Do you offer penetration testing in Sweden?
Yes. NordCodex is based in Malmö and provides scoped cybersecurity assessments for authorized web applications, APIs, mobile apps, desktop software and related systems. Many engagements can be delivered remotely.
Can you security-test an app built with Lovable, Cursor, Replit, Bolt, Claude Code or Codex?
Yes. We treat it as an AI-assisted or vibe-coded application security review. The review can include code, dependencies, secrets, authentication, database policies, APIs, mobile or desktop behavior, build/deployment configuration and live testing where explicitly authorized.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment focuses on identifying potential weaknesses across a broad surface. A penetration test goes further by validating selected weaknesses and attack paths within an agreed scope to demonstrate practical risk.
Can you test a production website or API?
Yes, when the owner explicitly authorizes the targets and production permissions. The scope should define safe rate limits, test identities, prohibited techniques and any data-changing actions before active testing.
Do you test AI and LLM applications?
Yes. Reviews can cover prompt injection, unsafe tool authorization, retrieval boundaries, sensitive-data exposure, insecure agent behavior and application-layer risks around LLM and RAG systems.
Need a penetration test or pre-launch security review?
Tell us what your application does, where it runs and whether it was built with AI. We agree the systems you can authorize us to test and the testing limits before work begins.