Every application has areas that should only be reachable after signing in, and areas that can stay open. Over time this often shifts unnoticed: a new feature is added, an exception stays in place, and in the end anyone on the internet can see customer data or business figures that should have required a login.
This check places every reachable point in your application next to the list of what should be protected and compares the two point by point. Any gap found is closed in the same pass, not just reported.
The check then stays behind as a script you can run again, for instance after the next extension of your application.
What ports as-is
- Every point that requires a login is captured: the default rule, the exceptions and the access used for automated calls
- That overview is matched against your own list of protected areas
- A clear rule for who may use any exception that remains
What we build for you
- The list of your endpoints and the configuration of your sign-in system
- The key scheme for automated calls between systems
