We test security before release.
We run our own pentest server. All the software we deliver goes through security testing on it before going live, and whatever the tests find is fixed before release.
- Pentest server
- our own
- When
- before going live
- What goes through it
- all the software we deliver
From code to live
Code
The software comes out of the build cycles ready to go live.
Pentest server
Before release, it runs on our pentest server, where we try to break in the way an attacker would. Whatever we find goes back to be fixed.
Production
Once the fixes are in, we publish.
What we test before release
The test changes with the sensitive parts of each project. In general, we look at these five areas.
Authentication
- login
- session
- password recovery
We try to get in without the right credentials, reuse a closed session and abuse password recovery.
Access control
- roles
- API routes
- IDs in URLs
We try to view or change data from another user, another company or a role above ours, by swapping identifiers and calling the API directly.
Injection
- forms
- filters
- parameters
We send inputs crafted to trick the database, the server or another person’s browser.
Data exposure
- API responses
- error messages
- public files
We look for what gets out unnecessarily: extra fields in responses, overly detailed errors, files and copies reachable from outside.
Server configuration
- ports
- headers
- certificates
- panels
We check open ports, security headers, certificates, exposed versions and admin panels that respond to anyone.
One limit
No test proves a system cannot be broken into. That is why the pentest comes with safeguards in the code itself, like the ones in the projects below.
Security already in the projects
Next to each project, where the information comes from.
- Data anonymized before AI
- Análise IA generates a report and action plan, with the clinic’s data anonymized before sending, as LGPD (Brazil’s data protection law) requires.
- Real-time audit log
- The audit screen records each operation by entity and by user and refreshes every 5 seconds.
- Data protection
- LGPD, AES-256 encryption in transit and at rest, daily backups with 90-day retention, multi-factor authentication and 99.9% uptime.
The audit log in the public ALYX demo, in demo mode. - Webhooks with retry and idempotency
- If an event delivery fails, the webhook tries again. With idempotency, an event that arrives twice is processed only once.
- Bearer token
- Every call to the REST API authenticates with a Bearer token.
- Full sandbox
- Integrations are tested in the sandbox before moving any money.
- Risk rules
- The back office controls transactions, fees, risk rules and withdrawals.
- Row Level Security
- Access rules live in the database itself, with Row Level Security on Supabase. Every query goes through the database policies before returning any row.
- Roles per company
- Each company has its own workspace, with owner, admin, member and reader roles.
- Safe extraction
- When extracting, nothing is written outside the destination folder. Links are blocked, name collisions are refused, and the process has size limits, temporary staging and CRC checks.
- Signed updates
- Each automatic update is checked against a signed manifest and the file’s SHA-256.
- AES-256-GCM link
- A QR code turns the phone into a controller, with code pairing and a link encrypted with AES-256-GCM.
- No telemetry, no login
- The app runs on the user’s computer and sends no usage data out.
Talk to us about your project.
If the software will handle payments, health data or personal data, mention that in your first message.