Clerk Integration Penetration Testing
Clerk is not the weak point. The session checks, organisation roles and webhook handler your team built around it are. We pen test the code that decides who is signed in, which organisation they are acting as, and what an org:admin can do that an org:member cannot. CREST-certified testers, fixed price from £3,180 for a 2-day single-integration scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
org_id is the session claim that tells your backend which organisation a request is acting for. Read it from anywhere other than the verified token and you have built a way for one customer to reach another’s data.
The organisation a request acts for should come from the token you verified, not the URL it arrived on
Clerk issues a signed session token every time someone signs in, but nothing forces your backend to check it properly. Clerk’s manual JWT verification guide sets out the checks: signature, expiry and authorised party. A backend that decodes the token without them turns a forgeable string into a valid session.
Once a session is verified, the token carries an org_id and an org_role for whichever organisation is active. If a route trusts an organisation ID from a query parameter or request body instead of that claim, a member of one organisation can address another organisation’s data by changing an ID. The same applies to permission checks: Clerk ships two default roles, org:admin and org:member, and we check whether custom roles and Clerk’s has() and protect() helpers check the specific permission an action needs, rather than whether the user belongs to the organisation.
The rest of the integration carries its own risk: an invitation endpoint that does not check who is allowed to invite or what role they can grant, a webhook handler that trusts an unsigned event, a secret key that has reached client-side code, and middleware that protects the pages a user sees but not the API routes and server actions underneath them. Each of these is a place where Clerk did its job correctly and the integration did not.
SCOPE
What we pen test on a Clerk integration
Session token verification
Whether your backend verifies the Clerk session token’s signature, expiry and authorised party, using authenticateRequest() or manual verification against your instance’s public key, rather than just decoding it, and whether authorizedParties actually blocks tokens minted for a different origin.
Organisation isolation
Whether the organisation a request acts for is read from the verified session’s org_id claim or from a client-supplied parameter, and whether a member of one organisation can reach another organisation’s resources by changing an ID.
Roles and permission checks
Whether has() and protect() calls check a specific permission rather than only organisation membership, and whether an org:member session can reach actions meant for org:admin or a custom role with narrower permissions.
Active organisation switching
Whether an organisation ID or slug taken from the URL is checked against the user’s actual memberships before it is set as the active organisation, so a crafted link cannot switch a user into an organisation they do not belong to.
Invitations
Whether creating an organisation invitation is restricted to users with the right role or permission, whether the invited role can be tampered with before acceptance, and whether a revoked or expired invitation link still grants access.
Account and membership lifecycle
Whether removing a user or organisation membership in Clerk is actually reflected in your own systems, since that depends on your webhook handler consuming events such as user.deleted and organisation membership changes rather than Clerk enforcing it for you.
Webhook signature verification
Whether the webhook endpoint verifies the Svix signature on every request with Clerk’s verifyWebhook() helper, rejects unsigned or stale deliveries, and handles the retries Clerk sends on failure without processing the same event twice.
Publishable and secret key handling
Whether the secret key or a webhook signing secret has reached client-side code or a public repository, and what an exposed publishable key actually allows an attacker to do compared with what only the secret key permits.
Middleware route protection gaps
Whether clerkMiddleware() route matching actually covers every API route and server action in scope, since protection enforced only in middleware misses routes outside its matcher and Clerk’s own guidance is to check access again at the resource itself.
Session claims and metadata exposure
Whether custom claims added to the session token, such as public or unsafe metadata, expose more to the browser than intended, and whether the application keeps the claims Clerk recommends moving out of the token once they approach its size limits.
OUR PROCESS
Clerk Integration Penetration Testing: From Scope to Attestation
Map the integration
We catalogue every Clerk touchpoint in scope: middleware configuration, webhook endpoints, the server code that calls has() and protect(), and where publishable and secret keys are used.
Provision test accounts across roles
We work from test users and organisations covering every Clerk role and permission in scope, from a fresh invitee to an org:admin, so every cross-role and cross-organisation check is run against a real session.
Session, role and webhook exploitation
CREST-certified testers attempt cross-organisation access, permission bypass, invitation and webhook abuse, and privilege escalation between organisation roles.
Reporting and retest
Executive summary, technical report with CVSS scores and reproduction steps, a walkthrough call, and a free retest once fixes are in place.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Clerk pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Clerk Integration Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Clerk For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Clerk Integration Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Clerk integration?
A test organisation and a set of test user accounts covering each Clerk role you use, such as org:admin and org:member, plus either read access to your webhook handler code or a staging endpoint we can point Clerk’s webhook delivery at. We do not need your live Clerk secret key; test credentials are enough.
Will this touch our live user data or production Clerk instance?
No. Testing runs against a staging or dedicated test Clerk instance and test organisations you provision for us. If a shared instance cannot be avoided, we scope the engagement to test accounts only and agree data-handling rules with you before testing starts.
Are you testing Clerk itself?
No. Clerk’s own infrastructure, including dashboard.clerk.com, accounts.clerk.com and api.clerk.com, is covered by Clerk’s own vulnerability disclosure policy and is out of scope for us. We test your integration: the session checks, role logic, webhook handler and key handling your team built around it.
How long does a Clerk integration test take?
A single-integration scope like this one starts at 2 testing days, with results delivered around 5 working days after kickoff. Multiple organisations or an extensive custom-role setup take longer; we confirm exact days once we see your role matrix.
What is out of scope?
Clerk’s hosted sign-in and sign-up UI, its infrastructure, and its underlying authentication mechanisms are out of scope. We focus on how your application verifies sessions, enforces organisation roles and permissions, handles invitations, and processes Clerk webhooks.
Do you need our Clerk secret key?
No. We work with test publishable and secret keys for a dedicated test instance or organisation that you provision. Your production secret key should never be shared with a third party, including us.
We use custom roles and permissions, not just admin and member. Can you still test it?
Yes. We map every custom role and permission configured in your Clerk Dashboard and test each has() or protect() check against it, not only the two default roles.
Do you test our webhook endpoint specifically?
Yes. We check that the endpoint verifies the Svix signature on every request, rejects unsigned or replayed events, and handles duplicate deliveries safely, since Clerk retries webhook delivery on failure.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Clerk integration
Clerk is not the weak point. The session checks, organisation roles and webhook handler your team built around it are. We pen test the code that decides who is signed in, which organisation they are acting as, and what an org:admin can do that an org:member cannot. CREST-certified testers, fixed price from £3,180 for a 2-day single-integration scope, quoted within 24 hours.
