Pentesting built for the way SaaS breaks
SaaS has a signature flaw set: tenant isolation bugs, session handling that outlives logout, subdomains that quietly expire into someone else's hands. Notra probes those classes on your live product, evaluates candidates through a verification gate, and keeps watching after the audit ends.
How the run works
1 · Map
Crawl and fingerprint the app and its subdomains, inventory the routes and parameters, and note which surfaces exist behind login versus in public.
2 · Probe
Target the SaaS classics: authorization on tenant-owned resources, session and cookie handling, dangling subdomains, exposed files, vulnerable component versions.
3 · Gate
Candidates are checked against saved observations and harmless proof evidence where available. Low-confidence candidates are withheld; an authz finding needs supporting evidence rather than a plausible pattern alone.
4 · Evidence
Findings that pass verification can ship captured request and response evidence, plus plain-English fixes your engineers can act on without a call.
The SaaS flaw set, covered
Requests for tenant-scoped resources are replayed with altered IDs and stripped roles from the authenticated session. If an endpoint hands back another tenant's data, the finding ships with the proof — proof — or it doesn't ship.
Cookie flags, token lifetimes, logout behavior, and JWT weaknesses — the plumbing that decides whether one compromised session stays one session.
A DNS record pointing at a service you stopped using is an invitation. The audit checks dangling claims on your zone and proves (harmlessly) when one can be claimed.
The audit is a moment. SaaS is a stream.
Between releases
Monitor re-scans every domain daily from $49/domain/month and emails you on every change — so the flaw introduced in Thursday's deploy doesn't live until the next audit.
In the pipeline
The CI/CD gate calls the same engine from your pipeline, so a regression fails the build instead of your customers finding it. Setup is in the docs.
Across the portfolio
Pro ($199) covers 5 domains and Agency ($499) covers 25 with white-label reports — for teams whose surface is more than one app.
See what the evidence looks like in the sample verified report, or compare the one-time audit against a manual engagement before budgeting.
Questions SaaS teams ask
Can you test cross-tenant access with two accounts?
Partially, and honestly: today Deep+ ($299) accepts one authenticated session cookie. Cross-tenant probes run from that session against guessable or enumerable resource IDs — which catches the most common tenant-isolation bug: endpoints that check login but not ownership. Paired-role testing (attacker tenant A vs victim tenant B with controlled fixtures) is a human-pentest shape for now.
What should I do between releases?
Two things ship for this: Monitor ($49/domain/month) re-scans daily and emails you on every change, and the CI/CD gate lets your pipeline call the API so a build fails when a check regresses. Both use the same evidence standard as the one-time audit.
Can I share the report with enterprise customers?
You can share it as evidence: manifest-pinned runs, proof exhibits for findings that pass verification, and a methodology you can explain. It is not a signed letter from a certified assessor — if a customer demands that specific artifact, a manual engagement produces it, and Notra covers the months between.
Free scorecard first — about 16 passive checks, roughly a minute. The $149 Deep Audit if it flags anything real.
Related: continuous monitoring for the between-releases story, the CI/CD gate docs for pipeline setup, and pricing if you're mapping this across a portfolio.