Luca F.

I'm a senior penetration tester for SaaS companies that need to prove their security: a SOC 2 or ISO 27001 audit, an enterprise security review, or a launch. I test web applications, iOS and Android apps, APIs and LLM features by hand, at a fixed price with a retest included. OSCP and CEH certified, with 8+ years of hands-on penetration testing and 250+ tests delivered for 100+ clients in 35+ countries. My reports have been used as evidence in multiple SOC 2 audits. WHAT I TEST • Web applications: authentication, session management, broken access control and business logic flaws, following OWASP WSTG v4.2 • Mobile apps (iOS and Android): insecure local storage, Keychain and Keystore usage, certificate pinning, the app's backend API calls and runtime manipulation with Frida, following OWASP MASTG and MASVS • APIs (REST and GraphQL): object and function level authorization, tenant isolation and data exposure, following the OWASP API Security Top 10 • LLM and AI features: prompt injection, data leakage between users or tenants, and abuse of tools and function calling, following the OWASP Top 10 for LLM Applications HOW I WORK Automated scanners miss business logic flaws, broken access control and chained vulnerabilities, so my testing is manual, with tools in support. I work grey-box with real user roles, to check whether one customer can read or change another customer's data, which is where the most serious SaaS issues usually sit. The price is fixed and agreed after a short written scoping, so you know the full cost before we start. The retest is part of every engagement because fixes can introduce new vulnerabilities, so each remediation is verified before we close. I don't implement fixes myself, which keeps the assessment independent from your development team. Communication is written and asynchronous, which works well across time zones. WHAT YOU GET A report with an executive summary for management and auditors, and detailed findings for your developers. Each finding has a CVSS v3.1 score, a proof of concept with steps to reproduce, the business impact, remediation guidance and clear criteria to verify the fix. After the retest you receive an updated report with the status of every finding. On request I also provide a letter of attestation for auditors or customers, and a machine-readable version of the findings that your team can load into its own tools. GOOD FIT IF • You have a SOC 2 or ISO 27001 audit coming up and need a penetration test report as evidence • An enterprise customer is asking for a recent penetration test as part of its security review • You need the annual penetration test for Amazon's SP-API Data Protection Policy, covering Login with Amazon, OAuth token handling and the environment that processes Amazon data • You are releasing or updating an iOS or Android app that handles customer, health or payment data • You are launching a multi-tenant SaaS or a new AI feature and want it tested before real users arrive The same reports also work as penetration testing evidence for PCI-DSS, HIPAA and GDPR requirements. TO GET STARTED Send me the application URL or app store link, the user roles involved and your deadline. I'll reply within 24 hours with a scoped fixed-price proposal. A redacted sample report is available on request.