Pentesting built for the way SaaS breaks
SaaS has a signature flaw set: tenant isolation bugs, session handling that outlives logout, subdomains that quietly expire into someone else's hands. Notra probes exactly those classes on your live product, proves every finding, and keeps watching after the audit ends.
How the run works
1 · Map
Crawl and fingerprint the app and its subdomains, inventory the routes and parameters, and note which surfaces exist behind login versus in public.
2 · Probe
Target the SaaS classics: authorization on tenant-owned resources, session and cookie handling, dangling subdomains, exposed files, vulnerable component versions.
3 · Gate
Each candidate is re-proven with a harmless PoC. Under 0.8 confidence it never ships — an authz finding must reproduce, not merely look plausible.
4 · Evidence
Findings ship their exhibits — exact request and response — plus plain-English fixes your engineers can act on without a call.
The SaaS flaw set, covered
Requests for tenant-scoped resources are replayed with altered IDs and stripped roles from the authenticated session. If an endpoint hands back another tenant's data, the finding ships with the proof — proof — or it doesn't ship.
Cookie flags, token lifetimes, logout behavior, and JWT weaknesses — the plumbing that decides whether one compromised session stays one session.
A DNS record pointing at a service you stopped using is an invitation. The audit checks dangling claims on your zone and proves (harmlessly) when one can be claimed.
The audit is a moment. SaaS is a stream.
Between releases
Monitor re-scans every domain daily from $49/domain/month and emails you on every change — so the flaw introduced in Thursday's deploy doesn't live until the next audit.
In the pipeline
The CI/CD gate calls the same engine from your pipeline, so a regression fails the build instead of your customers finding it. Setup is in the docs.
Across the portfolio
Pro ($199) covers 5 domains and Agency ($499) covers 25 with white-label reports — for teams whose surface is more than one app.
See what the evidence looks like in the sample verified report, or compare the one-time audit against a manual engagement before budgeting.
Questions SaaS teams ask
Can you test cross-tenant access with two accounts?
Partially, and honestly: today Deep+ ($299) accepts one authenticated session cookie. Cross-tenant probes run from that session against guessable or enumerable resource IDs — which catches the most common tenant-isolation bug: endpoints that check login but not ownership. Paired-role testing (attacker tenant A vs victim tenant B with controlled fixtures) is a human-pentest shape for now.
What should I do between releases?
Two things ship for this: Monitor ($49/domain/month) re-scans daily and emails you on every change, and the CI/CD gate lets your pipeline call the API so a build fails when a check regresses. Both use the same evidence standard as the one-time audit.
Can I share the report with enterprise customers?
Yes, as evidence: manifest-pinned runs, proof-of-exploit exhibits on every finding, a methodology you can explain. It is not a signed letter from a certified assessor — if a customer demands that specific artifact, a manual engagement produces it, and Notra covers the months between.
Free scorecard first — about 16 passive checks, roughly a minute. The $149 Deep Audit if it flags anything real.
Related: continuous monitoring for the between-releases story, the CI/CD gate docs for pipeline setup, and pricing if you're mapping this across a portfolio.