Handoff Security / BUSINESS SECURITY
API security testing for Hong Kong businesses
Check whether agreed API actions protect customer data and respect user permissions.
Security testing from HK$7,800
What is an API?
An API lets your website exchange data or perform actions with other systems. A booking screen may call several API endpoints; an endpoint is not the same as a website feature. We confirm the actual endpoints with your maintainer.
What risks can security testing examine?
Within the agreed scope, we examine whether the server checks who is making a request, which records they may access and which actions their role may perform. Checks use authorised test accounts and agreed data.
Example: the server trusts the wrong account ID
In a fictional customer portal, a page sends an API request for a booking record. Within an authorised test scope, we check whether the server enforces record ownership and user role on the agreed endpoint. Hiding a button in the browser is not the same as enforcing permission on the server. This example is illustrative, not a client finding.
Is this a separate package?
API checks form part of the existing website and API security testing service. The starting scope is limited; additional endpoints, roles or workflows require a separate agreement.
What should I prepare?
Describe your customer journeys and ask your developer for the relevant API documentation, test accounts and authorisation arrangements. Do not send passwords, tokens or customer records through the enquiry form.
What we check
- Starting scope
- 1 app · Up to 2 workflows / 2 roles / 6 API endpoints
- What you receive
- Verified findings, business impact and practical repair guidance for your developer. Code changes are excluded.
- Walkthrough and retest
- One online walkthrough up to 30 minutes. One retest of original findings within 30 days after the report, up to 2 hours. Extra work agreed separately.
All limits apply together. Extra workflows, roles or endpoints need separate agreement; third-party systems are not automatically included.
Starting prices cover limited scopes. Scope confirmation precedes a fixed quote. Fees cover agreed work and deliverables, not findings; vulnerabilities and complete security are not guaranteed.
100% payment and written testing authorisation are required before testing begins. Before payment, the fixed quote sets out scope, deliverables, exclusions, fees, testing dates and expected delivery timing.
Full scope, exclusions and engagement termsLet’s start with your website.
No technical knowledge needed.
Enquire about my websiteExclude passwords, tokens, customer data, private links and sensitive screenshots.