Contentful Integration Security Review
A Contentful space issues three separate API tokens, and the wrong one in your frontend leaks unpublished content. We test which token you shipped, plus your roles, environments and webhooks. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
The Content Preview API behaves like the Content Delivery API except it also returns content that has not yet been published, so a preview token left in the wrong place shows visitors drafts your editors have not approved.
Why the token you choose decides what a Contentful integration exposes
Every Contentful space hands out three tokens with three different blast radii. The Content Delivery API, at cdn.contentful.com, is a read-only feed of published content meant for apps and websites; the Content Preview API is, according to Contentful’s API documentation, a variant of the same feed that also returns content nobody has published yet; and a Content Management token, personal or OAuth, carries the same rights as the account that issued it. We test which of the three sits in your public bundle, and whether that is the one that belongs there.
Access inside the space works the same way. Space roles start from five defaults, Administrator, Editor, Author, Translator and Freelancer, and only a space Administrator can edit or delete a role; anything beyond the defaults is a custom role, available only on Contentful’s Premium plan and above, with its own tab in the role editor for which environments a role can reach. An environment alias such as master is a static ID pointed at a target environment, and that target can be switched without touching a single API key, so a key or a role scoped to an alias can start serving a different environment’s content overnight. We map every role, environment and alias against what your integration is actually meant to reach.
Two more surfaces sit outside the roles model entirely. A webhook only proves where it came from if you switch on Contentful’s request verification and then check it yourself: the platform signs the request with a secret you provide and adds the result to an x-contentful-signature header, but nothing on Contentful’s side stops your receiver from ignoring that header and trusting any request that arrives at the endpoint. An installed app is similar: it can carry its own installation parameters, act under an app identity with a ten-minute access token instead of a user’s session, and hold a private key that grants write access to your content if it ever leaks. We test your space configuration and integration code, the same boundary we hold across every headless CMS review we run, never Contentful’s platform itself.
SCOPE
What we pen test on a Contentful integration
Content Delivery, Preview and Management API Token Scope
The Content Delivery API is a read-only feed of published content meant for apps and websites, the Content Preview API is the same feed but also returns content that has not yet been published, and a Content Management token, personal or OAuth, carries the same rights as the account that issued it. We test which token is actually deployed in your frontend build, and whether it is the one meant to be there.
Personal Access Tokens and OAuth Client Credentials
A personal access token authenticates the Content Management API as the Contentful user who created it, while an OAuth token is meant for a public integration requesting access to another user’s account. We check where each token is stored, whether it has been rotated since it was issued, and whether a personal token has been reused in server-side automation that should be running under its own identity.
Organisation and Space Role Assignment
Organisation roles, Owner, Admin, Developer and Member, control access to billing, apps and taxonomy at the organisation level, separately from the five default space roles, Administrator, Editor, Author, Translator and Freelancer, that decide what a user can create, edit or publish inside one space. We test what each assigned role and organisation permission actually reaches against what that user’s job needs.
Custom Roles and the Environments Permission
A custom role, available on Contentful’s Premium plan and above, is built from separate Content, Media, Environments and Permissions tabs in the role editor, and only a space Administrator can edit or delete it once created. We test whether a custom role’s Environments tab grants reach into environments the assigned team has no reason to touch.
Environment Aliases and API Key Targeting
An environment alias such as master is a static ID pointed at a target environment, and that target can be repointed without changing a single API key or its configuration. We test what happens to a key, a role or an integration scoped to an alias when its target environment changes, since nothing about the key itself has to move for that to happen.
Preview API Content Exposure in Draft Builds
The Content Preview API behaves like the Delivery API but also returns entries that have never been published, which is exactly what a preview build or an editor’s draft view is meant to show. We test whether that preview surface, and the token it runs on, is reachable by anyone with the URL rather than only the editors it was built for.
Webhook Signing Secret and Signature Verification
Request verification on a Contentful webhook is switched on, not automatic: once a signing secret is set, Contentful adds an x-contentful-signature header and a timestamp to every request, but checking either one is the receiving application’s own code. We test whether your webhook endpoint actually verifies the signature and the timestamp window, or accepts any request that reaches the URL.
Webhook Triggers, Filters and Payload Trust
A webhook fires from a content event on an entry, asset or content type, or an action event on a release, and can be filtered by environment ID, entity ID or content type ID so only the events your integration needs are sent. We test what each configured webhook actually sends, what your receiver assumes about the payload, and whether a filter written for one environment still behaves once environments or aliases change.
App Framework Installations and App Identity Tokens
An installed app stores its own configuration as installation parameters that are copied whenever a new environment is cloned, and it can act independently of any user through an app identity, authenticated with an access token issued for ten minutes at a time. We test what an installed app’s parameters expose and what its identity is able to reach beyond the task it was installed for.
App Keys, Access Grants and Custom Integration Code
An app key is a key pair used to request an app’s access token, and its private half grants write access to the Content Management API if it is ever exposed, while an access grant controls which other organisations may install the app at all. We review the custom code behind your apps and integrations, not the Contentful platform underneath them.
OUR PROCESS
Contentful Integration Security Review: From Scope to Attestation
Scope and Token Mapping
We agree the spaces, environments, aliases and accounts in scope, then map every Delivery, Preview and Management token, role, custom role and installed app before testing begins.
Automated and Token-Based Scanning
Authenticated and unauthenticated scanning across every role and token type, Delivery and Preview alike, plus targeted checks against known Contentful configuration weaknesses.
Manual Exploitation
A CREST-certified tester manually tests token scope, role and environment boundaries, webhook trust and app identity access, chaining findings where they compound.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Contentful pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Contentful Integration Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Contentful For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Contentful Integration Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Contentful integration?
A space membership with a role you control, so we see the same permission structure your team manages day to day, plus separate Delivery, Preview and Management tokens so we can test each on its own terms. Visibility of any custom apps, webhook handlers or server-side integration code speeds up coverage but is not required for black-box testing.
Does this touch our live data?
No. We test against a non-production environment or an environment alias cloned from your live space wherever one exists. Where only the production environment is available, any check that could affect real content is agreed and scoped in advance, and read-only checks are logged as they happen.
How long does a Contentful integration review take?
A single-platform Contentful engagement is scoped at 2 testing days as a starting point, rising with the number of roles, environments, custom apps and webhook integrations in play. Reporting and a walkthrough call follow testing, with a free retest once fixes are in.
Contentful is SaaS. What is actually in scope?
Contentful does not offer a self-hosted option, so we test the space configuration your team controls: roles, custom roles, environments and aliases, API tokens, webhook handling and any apps or integration code built on top of the platform. Contentful’s own infrastructure is managed by Contentful and sits outside this engagement.
What is out of scope?
The Contentful platform itself, since that is Contentful’s infrastructure to secure rather than something your space configuration changes. Marketplace apps you have not customised, and any infrastructure outside your Contentful integration, unless you scope a wider cloud or network review alongside it.
Does Contentful have a policy for reporting security issues?
Contentful runs a Responsible Disclosure Program (bug bounty) for vulnerabilities in its own platform, and penetration test reports covering Contentful’s infrastructure are available to existing customers through its Trust Center. That covers issues in Contentful itself, not the roles, tokens, environments, webhooks and apps you have configured, which is what this engagement tests, and we confirm Contentful’s current customer terms with you during scoping before any testing starts.
Do you test the apps and webhooks we have built, or just the core content model?
We test what your team has built on top of Contentful: installed apps and their installation parameters, app identity tokens, webhook signing and signature verification, and the server-side code that calls the Delivery, Preview or Management API. We do not test Contentful’s own platform or the internal code of apps you installed from its Marketplace.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Contentful integration
A Contentful space issues three separate API tokens, and the wrong one in your frontend leaks unpublished content. We test which token you shipped, plus your roles, environments and webhooks. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
