Application and API penetration testing for software teams.
Gray-box assessments with authorized scope, manual validation, reproducible evidence, and remediation guidance — packaged for security reviews, procurement, and platform approvals.
Built for teams that need credible application security testing before enterprise review, marketplace approval, or production launch.
- Marketplace approvalAmazon SP-API Data Transfer Mechanism evidence packs · Google CASA mapping · partner submissions.
- Enterprise procurementSIG, CAIQ, and custom questionnaires answered against a current, dated assessment.
- SOC 2 readinessExternal assessment evidence sized for a Type 1 or Type 2 examination period.
- Pre-launch & investor diligenceA defensible third-party report before the system is exposed to production traffic.
Three disciplines on every engagement.
Every engagement begins with a signed Authorization to Test.
Targets, environments, credentials, roles, and timing are documented and countersigned before the first request is sent.
Findings are confirmed by hand, not flagged by a scanner.
Every issue carries a reproducible request, an exact response excerpt, and a CVSS rationale a second reviewer can verify.
Remediation guidance references the affected route and the proposed fix.
One free retest is included. The retest letter is a separately dated artifact suitable for submission to a reviewer.
How an engagement runs.
Intake
You describe the system, roles, and the reviewer or marketplace driving the request.
Mutual NDA
Signed before any sensitive scope crosses. Out-of-band, countersigned PDF.
SOW · ATT · ROE
Statement of Work, Authorization to Test, Rules of Engagement — countersigned before any traffic is sent.
Active testing
Gray-box, manually validated, against the agreed environment and the documented surface.
Report & retest
Delivered with reproducible evidence and a separately dated remediation-verification letter.
What you receive at the end of the window.
A documented, dated, defensible package — assembled to the standard a skeptical reviewer expects. The report is a primary brand artifact, not a PDF wrapper around a scanner output.
Sample reports are available on request, redacted to remove client-identifying material.
- Doc 01Technical reportFull findings, evidence, severity rationale, and reproduction steps. Source Serif 4, archive-ready PDF.
- Doc 02Executive summaryTwo-page summary suitable for procurement, board, or marketplace reviewer review.
- Doc 03Evidence packRaw requests, responses, and reproduction notes. Mapped to each finding by ID.
- Doc 04Retest letterSeparately dated artifact confirming remediation against named commits or releases.
- Doc 05Independence disclosureFirst-class section in the report — relationship between Veyra and the client stated, not footnoted.
What Veyra does.
Web Application Penetration Test
Manual assessment of authenticated and unauthenticated flows against the OWASP ASVS L2 baseline.
Gray-Box API Penetration Test
Authorized, credentialed testing against documented API surfaces. Suitable for marketplace and SOC 2 readiness.
Amazon SP-API Evidence Pack
Data Transfer Mechanism evidence assembled to the documentation expected by an Amazon SP-API reviewer.
Marketplace Security Readiness Review
Pre-submission review for marketplace and platform security questionnaires, including documentation-gap remediation guidance.
What Veyra will not claim.
Some statements are easier to sell than to defend. The catalog below is enforced by a copy gate in the Veyra codebase — these phrasings will never appear in a Veyra report, proposal, or marketing page.
- Never"The application is secure" — or any equivalent.An assessment describes what was tested, what was found, and what was not in scope. It does not pronounce a system secure.
- Never"Amazon-approved", "Amazon-certified", "Amazon partner".Veyra is not affiliated with Amazon. Engagement deliverables are described as “aligned to Amazon SP-API requirements,” and only when the engagement maps.
- Never"AI-powered pentest", "fully automated assessment".Tooling is supporting evidence. Severity, exploitability, and remediation are determined by manual validation. Never described otherwise.
Read a redacted sample report, or describe the system you want assessed.
Engagement requests receive a reply from a named assessor within one business day.