Start with what could go wrong for a user
Before choosing a scanner, write down what your app handles and who should be allowed to do what. An app that stores family records, accepts payments or connects a repository has different boundaries from a public calculator.
List the important actions: sign in, view a record, edit it, invite someone, export it and delete it. For each one, identify the owner and the roles allowed to act. This gives a review a concrete purpose and makes gaps easier to see.
Review source and configuration together
Check the code and dependencies you are actually shipping. Look for credentials committed to source, unexpectedly broad permissions, unsafe handling of untrusted input and dependencies that need attention. Confirm that required secrets are configured for the intended environment rather than embedded in a client bundle.
A possible-secret finding needs human review. A public identifier and a live private key are different things. If a real credential was exposed, removing it from the current file alone is not enough: use the provider’s process to revoke or rotate it and assess where it was accessible.
Keep the exact revision with the result. “We ran a check last month” does not describe the release you are about to ship today.
Check access with separate test accounts
Use an app you control, dedicated test accounts and synthetic records. Give one account a test record and check whether a different account can read, change, export or delete it. Include signed-out requests and roles with less access.
The expected result should come from your access rules. A hidden button does not establish that the server refuses the same action. OWASP recommends denying access by default and validating permissions on every request; see its Authorization Cheat Sheet.
Keep these tests scoped to authorised environments. Do not use another customer’s real records to prove isolation, and do not run payment or deletion scenarios against production data merely to complete a checklist.
Keep findings, fixes and gaps separate
For each issue, retain enough detail to check the conclusion later: affected component, observed behaviour, expected behaviour, revision and the result after a fix. Record checks that could not run as gaps.
| Example result | What it establishes | Next action |
|---|---|---|
| A possible credential in source | A string needs investigation. | Establish whether it is sensitive and act through its provider if exposed. |
| A denied cross-account request | That request was refused in that test. | Check other relevant actions and roles. |
| A dependency finding | A dependency matched a reported issue. | Review applicability, update where appropriate and rerun. |
| A disconnected service | That part of the app was not checked. | Connect it or record the uncovered area. |
These are illustrative examples, not results from a customer app. A passing result is evidence about the checks that ran, not a security certificate.
Make the next release easier to review
Use the previous result as a starting point, then review what changed. A new role, sharing link, payment flow or data export can introduce a boundary that older tests never exercised.
Choose checks that answer those questions, review the evidence and rerun after changes. For specialist risks or a broader security assessment, involve a qualified professional with an agreed scope.
Where Suhail fits
Suhail brings selected source findings, supported Cloudflare configuration checks and authorised app tests into one workspace. It keeps evidence, checked revisions and coverage gaps together, with supported repair and review workflows.
Coverage depends on the files, connections and checks enabled. It is not comprehensive penetration testing or security certification, and a completed run does not guarantee an app is secure.
Use the setup guide to understand the connection steps, check the service limitations, and compare current plans against the apps you maintain.
Something we should improve?
Tell us which part was useful, unclear or out of date. Please leave out passwords and private account, family or financial details.
Send feedback →