Web2 security

Scope your Web2 security review

Tell us about your application, infrastructure, and timeline. We’ll use your answers to shape the right security engagement.

Contact information

First name

Last name

Telegram username

Organization name

Engagement context

Business requirement

What business requirement is driving the test—for example, compliance, a customer request, or strengthening your security posture?

Risk scenario

What is the worst-case business impact of a breach or hack?

Testing approach

Choose the level of information sharing you expect during testing.

White box—testers receive source code, user roles, environments, or other focused access

Black box—testers receive no internal information and discover the attack path independently

Gray box—testers receive limited information or authenticated access

Application scope

Application name

Testing schedule

Can testing take place during normal business hours?

User roles

How many user roles are in scope, and what are they?

Application functionality

Approximate the pages and application functions in scope.

API endpoints

Include the approximate number, API types, and representative examples.

Application architecture

Describe whether the application is a single-page application, traditional request/response application, or another architecture.

Cloud services

List any cloud-native services used by the application.

Technology stack

Include the frontend, backend, databases, and other important technologies.

Scope of testing

List all in-scope endpoints, URLs, and IP addresses.

Authentication

Will the test use authenticated access?

Authenticated

Unauthenticated

Application demo

Can your team demonstrate the application to the researchers?

Yes

Maybe—we need to discuss it

JavaScript is required to submit this form. Email hello@cantina.security.