RAID · E-commerce Pentest
We test your store, Shopify app or WooCommerce plugin the way a real attacker would.
The risk
Authorisation flaws that let anyone view or change other customers' orders.
Business logic that lets attackers pay less or stack discounts.
Sessions and password resets an attacker can abuse.
A flaw in your app is replicated in every store that installs it.
Packages
Each package includes everything in the previous one.
Indicative prices excluding VAT. Final price is confirmed after the scoping call.
Price: From €1,500
excl. VAT
Not included: login, roles, pricing logic, APIs or exploitation.
Price: From €5,000
excl. VAT
Not included: in-depth APIs, webhooks, infrastructure or code.
€1,500 off if you upgrade from RECON within 30 days (€3,500 net).
Price: From €9,000
excl. VAT
Not included: infrastructure, source code or post-exploitation.
Price: From €15,000
excl. VAT
Methodology
01
Scope and rules of engagement in writing.
02
Technologies, domains and in-scope assets.
03
Which assets matter and who would attack them.
04
Flaws found and ranked by risk.
05
Controlled proof that the flaw is real.
06
Impact proven, no persistence or real data.
07
Executive summary, technical detail and fix plan.
After the report
Included in OPERATION and TAKEDOWN. In Custom, depending on scope.
Sample report
A real report from our lab: methodology, CVSS-scored findings, reproducible evidence and a remediation plan. The same format you'd get for your project.
20 pages · PDF — Report from a lab environment, for demonstration. It contains no client data.
Developers
We audit your Shopify app or WordPress plugin before it reaches your customers.
Only on your development store or lab. Never on customer stores or with production credentials.
Compliance
Supports security of processing (Art. 32). Data minimised and never extracted.
Regular, documented testing as part of risk management.
Pentest evidence for Requirement 11.
Findings mapped to Annex A controls.
Always with written authorisation. The report doesn't guarantee compliance on its own.
FAQ
No. We sign rules of engagement before starting, never use denial of service and never extract real data. Production tests are scheduled around your traffic.
No. Only test or sandbox accounts and secrets.
No. Apps and plugins are only tested on your development store or lab.
2 to 10 days depending on the package. Critical findings are reported the same day.
We stop, notify your contact with evidence and a temporary mitigation, and agree how to proceed.
Yes. The report serves as evidence for GDPR (Art. 32), NIS2 and PCI-DSS (Req. 11). It doesn't guarantee compliance on its own.
Contact
Leave your company and email and we'll get in touch.