Security Testing
As part of the normal test cycle, GullySystem checks for the gaps functional testing walks past — one role seeing another's data, an unvalidated field, a missing permission check — not as a substitute for a full assessment.
What This Covers and Where It Stops
This is a practical check for the security gaps that show up during ordinary functional testing — broken access between roles, data visible to the wrong user, obviously unvalidated input. It is not penetration testing or a compliance audit, and it does not replace one. Where an application handles payments, health records or other regulated data, a dedicated application-security assessment is the right next step, and we will say so plainly rather than stretch this into something it is not.
What the Security Check Looks At
Access Between Roles
Whether a user in one role can reach a screen, record or action reserved for another by guessing a link or an identifier.
Session Handling
Whether logging out actually ends a session, and whether an old session token stops working the way it should.
Input Validation
Whether fields accept and store obviously malformed or oversized input that a properly built form should reject.
Data Exposure
Whether error messages, browser storage or API responses reveal more information than the screen actually needs to show.
Where This Fits Against a Full Assessment
This runs inside the same cycle as functional and regression testing, catching the obvious gaps early and cheaply. A full penetration test or secure code review goes far deeper — automated and manual attack techniques, infrastructure review, a written report scoped to a security standard — and is the appropriate step once the application is handling sensitive data at real volume or facing a compliance requirement.
A Wealth Management Firm's Client Portal, as an Example
A wealth management firm's client portal is checked, within the normal test cycle, for whether one client's statement link can be edited in the browser address bar to open a different client's holdings, and whether a junior-advisor role can be used to reach a senior partner's private notes it was never meant to see. Findings like these are raised immediately rather than waiting for a separate security engagement to begin.
Frequently asked questions
Is this a substitute for a penetration test?
No, and we are direct about that distinction. This catches obvious access and validation gaps as part of ordinary QA. A penetration test is a deeper, dedicated exercise for applications handling sensitive data or facing a compliance requirement, and we will recommend one separately when your application needs it.
Do you provide a compliance certificate or audit report?
No. This work produces defect reports for the issues found, in the same format as the rest of testing. A compliance audit or certification is a distinct, formal process handled under a dedicated security engagement, not something this level of testing is positioned to issue.
What kind of issues does this typically find?
Most commonly, one user role reaching data or actions meant for another, sessions that do not end properly on logout, and forms that accept input they should reject. These are usually oversights in how a feature was built, not sophisticated attacks, which is exactly why they surface during ordinary testing.
What drives the cost of this within a testing engagement?
How many user roles and permission combinations exist, and how many forms and API endpoints need input validation checks. It scales with the size of the application's role structure more than with its overall feature count.
What decides how long this security pass takes?
The number of roles whose access needs to be cross-checked against each other, and how many entry points — forms, uploads, API calls — are being checked for input handling.
When should we move to a full security assessment instead?
Once the application handles payments, health records, or other regulated or sensitive data at real volume, or once a client, partner or regulator specifically requires a security assessment. We will tell you directly when your risk profile has moved past what this level of checking is meant to cover.
Tell us what you need.
Send a short brief and one of our engineers will come back to you — usually the same day.
- No obligation
- We reply the same working day
- Your details stay private