OWASP WSTG//ASVS//PTES//MITRE ATT&CK//OWASP API TOP 10//CVSS 3.1//CWE//MANUAL TESTING//OWASP WSTG//ASVS//PTES//MITRE ATT&CK//OWASP API TOP 10//CVSS 3.1//CWE//MANUAL TESTING//
/01SERVICES
Offensive security focused on business impact
Every engagement is deep manual analysis. Scanners cover the trivial; we find the chains that compromise your data.
/01
Web Application Pentest
Full manual audit: access control, IDOR/BOLA, injections, business logic and the whole surface an automated scan ignores.
OWASP WSTGAuthzBusiness logic
/02
API & GraphQL Security
REST and GraphQL against the OWASP API Top 10: BOLA, BFLA, mass assignment, object-level authorization and cross-tenant data leaks.
API Top 10GraphQLMulti-tenant
/03
Cloud & Infrastructure
AWS/GCP/Azure: SSRF to metadata, credential exposure, open buckets, permissive IAM and unnecessary network surface.
AWS/GCP/AzureSSRFIAM
/04
Authentication & SSO
OAuth/OIDC, SAML and JWT: authentication bypass, session hijacking, account takeover and IdP integration flaws.
OAuth/OIDCSAMLJWT
/05
Attack Surface Assessment
Mapping the real perimeter: subdomains, forgotten assets, front-end secrets, reachable internal endpoints and shadow IT.
ReconSecretsDiscovery
/06
Continuous Security Testing
Recurring testing with a real attacker's mindset. For teams shipping often that need continuous coverage, not an annual snapshot.
RetestÁgilImpact-driven
/02APPROACH
Why companies choose debsec
The difference between a scanner report and a real reduction in risk is the depth of the analysis and the quality of the deliverable.
01
100% manual analysis
Scanners find the obvious. Real breaches live in business logic and multi-step chains that only a human analyst uncovers.
02
Proven impact, not theoretical
Every finding is shown with a reproducible PoC and real evidence. No "could be exploitable": if we report it, we confirmed it end-to-end.
03
Honest severity
CVSS 3.1 scoring aligned to real impact. No inflating risk to justify the report: your team prioritizes with data it can trust.
04
Bug bounty mindset
Proven experience competing against the world's best researchers in top-tier programs. The same rigor, applied to your organization.
05
Direct communication
You work directly with the researcher running the test. Critical findings are shared the moment they're found, not at the end.
06
Retest at no extra cost
We verify that your fixes close the vulnerability. The engagement isn't over until the risk is confirmed mitigated.
/03PROCESS
A clear process, from kickoff to retest
Transparent and collaborative. At every moment you know what's being tested, what was found and how to fix it.
01
Scoping
Scope & rules
Objectives, in-scope assets, testing windows and rules of engagement. NDA and authorization.
02
Testing
Manual execution
Deep recon and manual exploitation. Criticals are escalated immediately, they don't wait for the report.
03
Reporting
Deliverable
Executive + technical report with CVSS, CWE, reproduction steps and prioritized remediation.
04
Retest
Verification
We re-verify every finding after the fixes and deliver a closure attestation.
/04DELIVERABLES
A report your team can act on
For two audiences: leadership that needs to understand the risk, and engineering that needs to fix it.
+
Executive summary: risk posture in business language.
+
Technical detail per finding: CVSS 3.1 severity, CWE and real evidence.
+
Reproduction steps: copy-paste, to confirm and fix without guessing.
+
Prioritized remediation: what to fix first and how.
+
Retest & attestation: closure verification for audit or compliance.
// findings_summary.log
Broken Access Control (IDOR)CRITICAL
SSRF → cloud metadataCRITICAL
Authentication bypassHIGH
Mass assignmentHIGH
Sensitive data in JS bundleMEDIUM
Security headers missingINFO
// each with PoC + remediation:)
/05RESULTS
Real impact, under confidentiality
Every engagement runs under NDA. Anonymized results that illustrate the kind of risk we help close.
Fintech · SaaS B2B
"An access-control flaw exposed other customers' data through the API. No prior scan caught it. The PoC made it impossible to ignore."
IDOR
cross-tenant
<72h
fix + retest
E-commerce · Retail
"An internal endpoint followed an arbitrary URL and reached the cloud metadata. From there, temporary infrastructure credentials."
SSRF
→ IMDS cloud
Crit
CVSS 9.1
Digital banking
"A poorly validated JWT accepted a swapped algorithm. We signed a token with another user's role and the session took it as valid."
JWT
key confusion → ATO
Crit
account takeover
Marketplace · Gig
"Signup accepted a field the front end never sent. The backend didn't validate it: we created an account with administrator privileges."
Mass assign
privilege escalation
Admin
full access
Telecom · SaaS
"The auth middleware and the router parsed the path differently. A well-placed suffix skipped the control and exposed the internal panel."
Auth bypass
parser differential
Panel
internal exposed
Healthcare · Platform
"Direct communication with the person running the test. The critical reached us the same day it was found, not at the end. That made the difference."
GraphQL
BOLA → PII
Retest
verified closure
// anonymized cases · verifiable references under NDA on request
/06PRICING
Flexible engagement to fit your needs
From a one-off assessment to continuous coverage. The final price depends on scope: a fixed quote after scoping, no surprises.
One-off assessment
A complete pentest over an application, API or defined scope.
All engagements include an NDA, formal scope authorization and communication in EN / ES.
/07FAQ
What people usually ask before hiring
How long does a typical engagement take?+
It depends on scope. A pentest of a mid-sized web app takes one to two weeks of testing, plus the report. After scoping we provide a concrete schedule with start, delivery and retest-window dates.
What do you need from our side to start?+
A defined scope, formal written authorization to test it, and depending on the case test credentials or staging access. We sign an NDA before receiving any sensitive information.
Do you test on production or staging?+
Both. We prefer staging when a faithful replica exists, to remove operational risk. If testing must run on production, we agree on windows, limits and a direct channel to pause at any incident.
How do you handle confidentiality?+
Everything under NDA. Findings, evidence and any data accessed are treated as confidential and shared only through secure channels. We never disclose a client's information or use it outside the authorized scope.
What happens if you find something critical?+
We don't wait for the final report. Criticals are communicated immediately through the agreed direct channel, with evidence and initial mitigation recommendations, so you can act as soon as possible.
Does the retest cost extra?+
No. Every engagement includes a retest: after the fixes we re-verify each finding and confirm closure. We deliver an attestation useful for audit, clients or compliance.
Do you work with companies outside Chile?+
Yes. The work is remote and we collaborate with companies across LATAM, Europe and the US. Reports are delivered in Spanish or English, coordinating around your time zone.
/08CONTACT
Request a proposal
Tell us your scope (application, API or infrastructure) and we'll reply with a plan and a no-commitment quote, usually in under 24 business hours.