Secure Code Review and Application Security
Business Logic and Authorization Analysis
We test the rules that define who can do what in your application, both in the code and in the running application. We identify where a customer can access another customer's data or where an approval step can be bypassed.
What it is
A business logic flaw occurs when code works technically as intended but allows an incorrect action. For example, a user viewing another customer's record by changing a record number. Automated scanners cannot detect these flaws because they do not know which rules the application should enforce. The analysis compares your role and permission matrix with the actual controls in the code.
Scope
- Each endpoint compared with your role and permission matrix
- Verification that each record is accessible only to its owner and authorized roles
- Separation of customer data in multi-tenant environments
- Application of the four-eyes principle in request and approval steps
- Rounding and boundary values in amount, limit, and exchange rate calculations
- Exceeding a limit or single-use right through concurrent requests
The need
When organizations need it
- Before launching a customer or dealer portal with multiple roles.
- When a customer reports seeing data belonging to another customer.
- When software handling card data must demonstrate the business logic and access control protections required by PCI DSS.
Method
How we work
-
Rules
We document roles, approval flows, and limits in a matrix together with your business units.
-
Code comparison
We identify where and how each rule in the matrix is implemented in the code.
-
Role-based testing
We use separate test accounts for each role to verify that the rules are enforced in the running application.
-
Remediation
We work with your developers to design a remediation that centralizes the authorization check.
Outcome
What you have at the end
You receive a verified overview of which role can perform which action, in both the code and the running application. Every rule failure is listed with its impact and remediation.
Frequently asked questions
Is source code required for this analysis?
No. The analysis can also be performed on the running application using role-based test accounts. Access to source code helps identify missing checks and recurring issues more quickly.
Does a penetration test find these flaws?
A role-based penetration test may find some of them. This analysis covers flaws in business rules that a tester would not know, as the rules are defined together with your business units.
Are amount and limit tests performed in production?
These tests are run in a test environment because they could affect real money and customers. In production, only non-intrusive checks are performed, and only with your approval.
Secure Code Review and Application Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting