Case Study / API penetration testing
AI features route user input straight into a model, and most API test plans never go near them. A SaaS product with AI-powered features engaged us to close that gap: a two-week API vulnerability assessment and penetration test across its documented surface, run to NIST SP 800-115 and the OWASP API Security Testing methodology. Scoping happened with the testers who would do the work, and it put the AI-processing endpoints, file upload, and account workflows first as elevated-risk surface.
SaaS · AI product · API VAPT
An AI text-rewrite endpoint took a user-controlled parameter straight into the model prompt. Crafted instructions in that parameter overrode the intended function and made the model follow arbitrary instructions, the class of flaw that can leak system prompts or hidden context when an AI is wired to other tools and data. Insufficient isolation between system and user content was the root cause.
Upload endpoints accepted files without enforcing an allow-list of extensions, MIME types, or content signatures: a path to hosting malicious content and, in some deployments, code execution.
Even where filtering existed, a null-byte double-extension trick slipped disallowed file types past validation. Demonstrated, not asserted.
OTP verification endpoints had no rate limiting, CAPTCHA, or throttling, leaving one-time codes open to brute force.
A tail of lower-severity issues: thin server-side input validation (HTML/JS acceptance), weak password-history control, information disclosure via server headers, and missing security headers.
Direct API testing of server-side controls, authorization enforcement, and input validation across the documented endpoints, prioritized by attack surface: AI processing, file upload, and account management first.
Every finding was validated for exploitability by hand. The prompt-injection and upload-bypass issues were demonstrated end to end.
The engagement treated the AI endpoints as their own attack surface (prompt isolation, instruction handling, and model-integration boundaries), an area most API tests skip entirely.
Findings were grouped by affected functionality with specific server-side fixes, so the team could remediate by area rather than chase a flat list.
Client identity is confidential by agreement. The engagement is published anonymized; we never publish metrics we didn't measure.
AI endpoints deserve elevated-risk scoping from day one: they are business logic wired to a model, and standard API test plans walk straight past them. The second lesson is older. Upload validation that trusts a filename remains the quickest way past a filter, and a single null byte was enough to prove it here.
A 30-minute call with the engineers who will do the testing, not a sales gate.