Do you need our source code?

Not necessarily, but it makes the test better. Black-box testing shows you what an attacker sees. White-box testing, where you provide source, shows you everything they would eventually find given enough time — and it finds it faster. Our team reads and writes across the common language and framework landscape, so providing source is rarely wasted.

Do you test with user accounts, or only from outside?

Both, and the authenticated half is usually where the serious findings are. Most high-impact web vulnerabilities are authorization failures — one user reaching another user’s data, or a standard role performing an administrative action. Those are invisible without credentials, so we ask for at least one account per role.

Is this just an OWASP Top Ten checklist?

The OWASP Top Ten is the floor, not the ceiling. We cover it in full, then spend the majority of the engagement on the things a checklist cannot describe: business logic, workflow abuse, and the systemic flaws that come from how your particular application was designed.

Web Application Penetration Testing

What we offer

Brackish delivers high-quality web application testing by seasoned testers. That includes unauthenticated and authenticated testing, and white-box testing against your source code where you can provide it.

The goal is a clear, honest picture of the vulnerabilities in your application — not a scanner export with a cover page attached. Every finding we report has been confirmed by hand.

OWASP coverage and beyond

We cover the OWASP Top Ten in full, and then keep going. The findings that matter most are usually the ones no checklist can anticipate: business logic that can be driven somewhere it was never meant to go, and deeper systemic flaws in how the application was put together.

White-box testing

Our team is comfortable reading and writing across almost any language or framework you are likely to be running. Where you can share source, we use it — it turns a time-boxed search into a systematic review and consistently finds issues that black-box testing would miss. A dedicated review of the repository itself, rather than source as an aid to a running-app test, is secure code review. If the application is an LLM, an agent, or a RAG pipeline, and the question is what the model will do rather than what HTTP will give up, that is AI penetration testing.

Real-world attack simulation

We reconstruct authentic attack scenarios specific to web applications, so you understand the actual attack vectors against your system rather than a generic threat list.

Backend API testing

Most web applications are a thin layer over a backend API, and the API is often less defended than the interface in front of it. We test that the communication between them is secure and that the endpoints behind it hold up on their own.

Reporting you can act on

We do not hand over a list of vulnerabilities and leave. Findings are prioritized by risk, the implications of each are spelled out, and the remediation advice is specific to your codebase rather than a link to a generic reference.

Why choose Brackish

Choosing who assesses your applications is a decision about your users, your data, and your business. Our approach combines deep technical expertise with direct collaboration — you talk to the people doing the testing, not an account manager relaying messages.

Diverse expertise. Our team knows the language and framework landscape, common application architectures, and the web-specific threats that come with each of them.

Tailored testing. Every application is unique. We build the testing approach around your architecture, your functionality, and your threat landscape rather than running the same playbook on everything.

Commitment to the fix. Identifying vulnerabilities is half the job. We support you through remediation and retest afterwards to confirm the fix is effective and has not introduced something new.