Cyber Security Services
Web and API penetration testing, application security review, red-team engagements and remediation. Defined scope, actionable evidence and retesting for Philippine and international clients.
Understand how your application could be abused
Rootscratch provides cyber security services for businesses in the Philippines and worldwide, including web application penetration testing, API reviews, scoped red teaming and remediation support.
The engagement starts with the system, the business concern and written authorization. We agree on the assets, accounts, environment, methods, testing window and communication process before active testing.
Choose the assessment that matches the question
Web application and API penetration testing
Examine authentication, sessions, role boundaries, business workflows, input handling, uploads and exposed endpoints within the agreed scope. Testing considers whether a user can reach information or actions beyond their intended access, including differences between customer, staff and administrator roles.
API work can include object-level access, account boundaries and the effect of unexpected request sequences. Findings are verified in context; automated alerts are evidence to investigate rather than a finished assessment.
Application and source-code security review
Review relevant implementation and configuration when source access is available. Areas can include permission enforcement, credential handling, dependencies, data flows and deployment settings. We document what was examined and what remained outside the review.
Red teaming
A red-team engagement is organized around an agreed objective and scenario, such as assessing whether a defined attack path can reach a protected application or whether the responsible team detects the activity. Scope, permitted techniques, third-party boundaries, stop conditions and contacts are agreed separately.
Red teaming and a vulnerability assessment answer different questions. We help define the appropriate engagement and confirm the capabilities and access needed before committing to the exercise.
Hardening, remediation and retesting
Confirmed issues can lead to application fixes, permission changes, dependency updates or configuration improvements. Repairs are checked against the original behavior and important user journeys. Retesting records whether the agreed issue was resolved and whether limitations remain.
What you receive
A scoped assessment can include:
- An executive summary connecting findings to the affected business functions.
- The systems, roles, environment and coverage examined.
- Confirmed findings with prerequisites, evidence and impact.
- Prioritized remediation recommendations for the responsible team.
- Limitations, unanswered questions and areas requiring further access.
- Retest results for fixes included in the engagement.
Evidence is handled through agreed channels. Reports should contain enough detail to reproduce and repair the issue without unnecessarily distributing customer information or credentials.
Testing a production system
We discuss a suitable environment and testing window before work begins. For production testing, the plan covers excluded actions, operational contacts and when testing must stop. Third-party services require appropriate authorization and provider conditions.
An assessment reports what was tested and observed at a particular time. Ongoing monitoring, emergency response and specific response-time commitments require their own defined arrangement.
Development and security working together
Rootscratch also provides web development, custom applications and system maintenance. When remediation is included, the developer receives concrete findings and acceptance checks rather than a list of unexplained scanner output.
Questions before commissioning testing
What is the difference between a scan and penetration testing?
A scan identifies potential issues using automated checks. Penetration testing adds contextual investigation and validation within authorized boundaries. Coverage and reporting should be clear in the scope.
Can you test without source access?
Some application testing can use authorized accounts and public interfaces. Source access supports additional review. We record the access level and its effect on coverage.
What should I include in an inquiry?
Provide the application address, its purpose, the roles involved, your authorization and the question you want answered. Share credentials and sensitive evidence only through an agreed secure process after scoping.
Rootscratch is based in Koronadal City, South Cotabato, serving clients throughout the Philippines and internationally. Read our security review scope guide, learn about Rootscratch, or request an assessment discussion.