Lab-based proof, not real client data

Agnite Security Lab

The lab shows how SaaS security failures appear in real API behavior: tenant data, object access, role permissions, paid features, webhook results, API key responses, and session state being accepted when they should be blocked.

This is a lab-based trust layer for the public audit story, not real client data or an exploit playground.

Why the lab exists

SaaS leaks often look like normal API traffic

Most SaaS security failures do not look dramatic in logs. They look like normal authenticated requests returning data, state, or access they should not.

01

Normal request, wrong data

The lab shows how normal authenticated traffic can return data, state, or access it should not have.

02

Evidence before opinion

Each scenario captures the actor, target boundary, unsafe response, and secure response in a public-safe format.

03

Built for SaaS boundaries

The scenarios center on tenants, roles, billing, exports, webhooks, API keys, sessions, and audit logs.

Scenario coverage

Representative SaaS failure patterns

The lab does not try to simulate every security issue. It focuses on the SaaS boundaries buyers most often need to see covered.

01

Tenant isolation bugs

Tenant A can access records, invoices, reports, or files belonging to Tenant B.

02

IDOR / BOLA

A user changes an object ID and receives data they are not authorized to access.

03

RBAC bypass

A lower role performs owner or admin actions because the backend trusts weak role checks.

04

Billing workflow abuse

Plan, invoice, or paid feature state is accepted from the client instead of trusted billing records.

05

Webhook trust failures

Unsigned, replayed, or fake webhook events change credits, plans, or entitlements.

06

Broken authentication

Expired tokens, reused reset links, old sessions, or missing re-auth checks are accepted.

07

Export and download leaks

Bulk exports, reports, or download links return unscoped tenant data.

08

API key scope failures

Deleted, overpowered, or wrong-tenant API keys still access protected resources.

09

Weak audit logging

Denied access, support actions, webhook failures, or suspicious object requests lack useful audit context.

10

Abuse and rate-limit gaps

Login, reset, invite, export, or webhook paths accept repeated requests without throttling or abuse controls.

Evidence flow

From request to finding

Each scenario follows the same review pattern: send a controlled request, compare the actor and target, confirm the unsafe behavior, then confirm the fixed behavior.

01

Controlled actor

A known user, role, token, or API key sends a request against one boundary.

02

Known boundary

The test checks whether the actor is allowed to reach the target tenant, object, feature, export, webhook, or session.

03

Vulnerable response

The unsafe response shows the boundary failed, such as returning foreign data or accepting an invalid state.

04

Fixed response

The fixed response blocks, scopes, rejects, or filters the same action.

Example proof patterns

What a finding looks like

The public pages do not expose raw lab data, but each sample finding follows a consistent structure.

Critical Tenant isolation

Cross-tenant invoice access

Alpha user receives Beta invoice data.

Vulnerable response returns foreign tenant data. Fixed response blocks the same request.

Critical Billing workflow

Fake plan upgrade accepted

Client-supplied payment state unlocks an enterprise plan.

Vulnerable response accepts the upgrade. Fixed response rejects client-controlled billing state.

High Broken authentication

Expired token still works

Expired session token still reaches a profile endpoint.

Vulnerable response accepts the token. Fixed response returns unauthorized.

Lab boundaries

What this page does not claim

The lab is a proof system, not a fake client story or a public exploit target.

01

Not real client data

The scenarios use fictional tenants, users, roles, and workflows.

02

Not a public vulnerable API

The public site does not expose raw source code, curl commands, localhost URLs, seed data, repo names, or vulnerable internals.

03

Not a fake case study

The lab demonstrates representative failure patterns without pretending they came from a real client engagement.

04

Not a replacement for your audit

It is a preview of the method, not the final engagement.

Audit support

The lab makes the audit easier to understand

The lab gives buyers and engineering leads a simple way to understand what the audit tests before those same checks are applied to a real SaaS product.

01

Clearer scope

Buyers can see the exact SaaS boundaries that the audit is meant to test.

02

Better proof

The lab shows the shape of the evidence without exposing raw internals or real client material.

03

Stronger remediation

The same review style helps engineering teams understand what needs to change after a finding is confirmed.

04

Easier buyer review

Founders and engineering leads can review the audit story before the same checks are applied to their SaaS.

Related proof assets

Review the public proof set

Report preview

Sample Audit Report

See how the lab becomes a buyer-facing report with context, impact, and retest guidance.

Open report
Finding examples

Sample Findings

Review sample findings that show the evidence format behind the audit story.

View findings
Audit checklist

SaaS Security Audit Checklist

See the audit checklist that maps the boundaries the lab models.

Open checklist
Audit service

SaaS Security Audit

Request the same request-level review for your tenants, roles, billing flows, exports, webhooks, API keys, and sessions.

Request audit
Related service pages

Connect the lab to live audit paths

These service pages use the same boundary ideas shown in the lab, but apply them to real audit scopes.

Related audit

API Authorization Audit

Request-level authorization testing for actors, roles, tenants, and object access.

Open audit
Related audit

Tenant Isolation Audit

Boundary testing for tenant-scoped reads, lists, exports, and shared-resource access.

Open audit
Related audit

RBAC Audit

Role and permission validation for admin paths, exports, and object access.

Open audit
Related audit

Object-Level Authorization Audit

Resource-level access testing across records, files, reports, exports, and nested resources.

Open audit
Related audit

Broken Access Control Audit

Runtime access control testing across actions, roles, objects, and permission boundaries.

Open audit
Related audit

IDOR Testing

Copied IDs, file IDs, and report IDs used across users or tenants.

Open audit

Want this tested against your SaaS?

The lab shows the proof format. The audit applies the same request-level review to your tenants, roles, billing flows, exports, webhooks, API keys, and sessions.