Directus Penetration Testing for Roles, Policies and Flow Automation
Directus separates roles, the policies attached to them, and the item-level filters and field lists that narrow a permission down to specific rows and columns. We test how your team has assembled that structure: what the Public role can reach without a token, whether a policy meant for one collection has bled into another through the way field permissions combine, and whether the custom endpoints, hooks, operations and Flows built on top of the platform enforce the same rules as the core API. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Field permissions from every policy assigned to a user are merged together. A second policy can add fields on a collection; it cannot take a field away once another policy has already granted it.
Why Directus permission gaps come from configuration, not the platform
Directus builds access control from four layers: roles group users, policies attach to a role or directly to a user, and permissions on each policy set what a collection allows before item-level filter rules and field lists narrow that down to specific rows and columns. Directus’s own access control documentation sets out how policies combine once more than one applies: field permissions merge additively across every active policy, while IP address restrictions work the other way, dropping any policy whose allowlist does not match the request. We test what a user ends up with once every applicable policy has combined, not just what a single policy says in isolation.
The Public role covers every request that arrives without a token, and Directus ships it with every permission switched off. A collection given public read access, even briefly while a front end is built, exposes every item in it to any unauthenticated request, so we check what the Public role can reach against what your site actually needs it to see. We test the same combination logic against your other roles, and against the static, session and standard access tokens issued to integrations and end users, since a token or a policy left broader than the job it does is exactly the kind of gap this engagement is built to find.
Custom code sits inside the same server process as the platform. Custom endpoints, hooks and operations run with the same access to Directus’s internal services as the core API, and a Flow can run under its own permissions, execute a Run Script operation as Node.js code, or expose a webhook trigger as a public URL if it is not given its own authentication check. We test the custom extensions and Flows your team has built on top of Directus, and, where the project is self-hosted rather than run on Directus Cloud, the server and storage configuration around it.
SCOPE
What we pen test on a Directus instance
Public Role and Unauthenticated Access
Directus ships the Public role with every permission switched off, since it applies to any request that arrives without a token. We test exactly what the Public role can reach against what your front end is meant to expose without authentication, and check for collections opened during development that are still switched on.
Roles, Policies and Custom Permission Sets
Policies carry the actual permissions and attach to a role or directly to a user, so the same policy can end up granting access through more than one route into the project. We map every role and policy in scope and test what a user ends up with once every attached policy is combined, not what a single policy states on its own.
Item-Level Permission Filter Rules
A policy’s collection-level permission can be narrowed with a filter rule that limits access to specific items, for example rows a user created themselves. We test whether these filter rules are present where the data model needs them, and check the same boundary across the collections reachable through the REST and GraphQL APIs.
Field-Level Permission Combination
Field permissions from every policy applied to a user merge together, so a policy written for one purpose can grant fields on a collection that another policy was meant to withhold. We test which fields a user can actually read or write once every applicable policy has combined, rather than checking each policy on its own.
File and Asset Access Controls
The directus_files collection records which storage adapter holds each asset, and the Public role has no permission to upload files by default. We test who can create, replace or delete files, and whether assets meant to stay private are only reachable with a valid Authorization header rather than a token sitting in a shareable URL.
Static, Session and Standard Token Scope
Directus issues standard, session and static access tokens, each scoped to the permissions of the user or service account it belongs to. We test where static tokens are used, what they can reach, and whether a token built for one integration has been reused somewhere with a wider reach than that integration needs.
Custom Endpoints, Hooks and Operations
Custom endpoints, event hooks and Flow operations run inside the same Directus server process as the core platform, with access to its internal services rather than sitting behind the permission system as an external caller would. We review this custom code for the authorisation checks the core API would otherwise enforce automatically.
Flows, Webhook Triggers and Run Script Operations
A Flow can be started by a webhook, and that trigger URL functions as a public endpoint unless it is given its own token or shared-secret check. We test webhook triggers for that authentication, and audit any Run Script operation, since it executes Node.js code under the Flow’s own permissions.
System Collection Write Access and Privilege Escalation
directus_users, directus_roles, directus_policies, directus_flows and directus_extensions are collections like any other, governed by the same permission system, and write access to them changes how the project behaves for every user. We test whether a non-administrator can reach any of them, since update access on directus_policies or create access on directus_users is enough to grant a role or an account more than it should have.
Self-Hosted Infrastructure vs Directus Cloud
Self-hosted, your server, database and file storage sit in scope alongside the Directus application itself. On Directus Cloud the underlying infrastructure is managed for you, so testing concentrates on the roles, policies, tokens, extensions and Flows your team has configured on top of it.
OUR PROCESS
Directus Penetration Testing: From Scope to Attestation
Scope and Policy Mapping
We agree the environments, roles and accounts in scope, then map every role, policy, static token, custom extension and Flow trigger configured in the project before testing begins.
Role and Policy Combination Testing
We test the Public role and every custom role for what they can reach once their attached policies, item-level filters and field permissions are combined, not what any single policy allows on its own.
Manual Exploitation
A CREST-certified tester manually tests permission boundaries, token scope, and the custom endpoints, hooks, operations and Flows built on top of Directus, chaining findings where they compound.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Directus pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Directus Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Directus For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Directus Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Directus instance?
An administrator account with a role you control, so we see the same policy structure your team manages day to day, plus credentials for each custom role and visibility of the Public role’s unauthenticated view. Access to any custom extensions or Flows in your deployment repository speeds up coverage but is not required for black-box testing.
Does this touch our live data?
No. We test against a staging environment or a cloned copy of your project wherever one exists. Where only production is available, any check that could affect real data or trigger a live Flow is agreed and scoped in advance, and read-only checks are logged as they happen.
How long does a Directus penetration test take?
A single-platform Directus engagement is scoped at 2 testing days as a starting point, rising with the number of roles, policies, custom extensions and Flows in the project. Reporting and a walkthrough call follow testing, with a free retest once fixes are in.
Is self-hosted Directus tested differently from Directus Cloud?
Yes. Self-hosted, your server, database and file storage are in scope alongside the application and its configuration. On Directus Cloud the underlying infrastructure is managed for you, so testing concentrates on your roles, policies, tokens, extensions and Flows.
What is out of scope?
The Directus core codebase itself, since that is Directus’s platform to secure rather than something your configuration changes. Third-party extensions you have not installed, and any infrastructure outside the Directus project, unless you scope a wider cloud or network review alongside it.
Does Directus have a policy for reporting security issues?
Directus runs a responsible disclosure programme for its own platform: vulnerabilities in Directus core are reported through a private GitHub security advisory or to security@directus.com, and the team credits researchers who follow that process. That covers issues in Directus itself, not the roles, policies, tokens, extensions and Flows you have configured, which is what this engagement tests. If you run on Directus Cloud, we confirm Directus’s current customer testing terms with you during scoping before any testing starts.
Do you test the Flows and custom extensions we have built, or just the core platform?
We test what your team has built on top of Directus: custom endpoints, hooks, operations, and every Flow and its trigger, since these run inside the same server process as the core platform so they need the same access checks the core API applies. We do not test the Directus core codebase itself.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Directus project
Directus separates roles, the policies attached to them, and the item-level filters and field lists that narrow a permission down to specific rows and columns. We test how your team has assembled that structure: what the Public role can reach without a token, whether a policy meant for one collection has bled into another through the way field permissions combine, and whether the custom endpoints, hooks, operations and Flows built on top of the platform enforce the same rules as the core API. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
