Flask Penetration Testing
Flask signs the session cookie but never encrypts it, so its holder can read every value inside. We test what it carries, the templates rendering it, and the extensions guarding it. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Flask ships no built-in login system, CSRF protection or CORS handling. Those arrive through an extension or your own code, and each one has to be configured correctly.
Why Flask findings are what Flask left for you to enforce
Flask’s session object is built on a cookie that is signed cryptographically, not encrypted, so a user can read every value you put in their session even though changing one requires your SECRET_KEY. That same key signs the CSRF token Flask-WTF issues by default, so a key that is weak, hardcoded or shared across environments puts both the session and the forms built on top of it at risk. We test what actually goes into the session, whether SESSION_COOKIE_SECURE was turned on for HTTPS-only delivery given Flask leaves it off by default, and how the key was generated and rotated.
Jinja2 autoescaping covers templates rendered through render_template() and every string passed to render_template_string(), but that only escapes the variables a template outputs, not the template source itself. Where request data reaches the string given to render_template_string() or Template(), Jinja2 compiles it as template syntax rather than displaying it as text, a route to arbitrary code execution that autoescaping does nothing to stop. The |safe filter and the Markup() helper carry the opposite risk, marking a value trusted not to be escaped again, so we test both for a value that a user, not your own code, actually controls.
Flask-Login, Flask-WTF and Flask-CORS are all optional additions, and each is only as strict as how it is configured: Flask-CORS’ own documentation states its extension enables CORS support on all routes, for all origins, by default, and a login_required decorator only protects the view it is actually applied to. Debug mode carries the same opt-in logic in reverse: turn it on and an unhandled exception opens a Werkzeug console capable of executing arbitrary code, held back only by a PIN that WERKZEUG_DEBUG_PIN can switch off entirely. Where a Flask service is one of several Python processes sharing the same secrets, database and workers, our wider Python penetration testing covers what sits outside a single Flask app.
SCOPE
What we pen test on a Flask application
Session Cookie Contents and SECRET_KEY Strength
Flask’s session cookie is signed with your SECRET_KEY but never encrypted, so its holder can read every value inside even though they cannot change one without that key. We test what the session actually stores, whether SESSION_COOKIE_SECURE is set given Flask leaves it off by default, and how strong, unique and rotated the signing key is.
Server-Side Template Injection via render_template_string
render_template_string() compiles whatever string it is given as a Jinja2 template, and Flask’s own autoescaping only escapes the variables that template outputs, not the template syntax itself. We test every render_template_string() or Template() call reachable from request data for that gap, since a successful injection can reach arbitrary code execution rather than just a reflected script.
Autoescaping Scope and the |safe Filter
Autoescaping covers render_template() and render_template_string() output, but a value passed through the |safe filter or wrapped in Markup() is trusted not to be escaped again. We test which templates and filters opt out of autoescaping and whether any of them render a value a user, not your own code, controls.
Flask-Login Session and Route Protection
A login_required decorator only protects the view it decorates, and Flask-Login’s user_loader has to correctly return None for a suspended or deleted account or the session stays valid regardless. We test every route that should require a session for a decorator that was left off, and whether a sensitive action such as a password change also requires fresh_login_required rather than accepting a session restored from a remember-me cookie.
Flask-WTF CSRF Token Configuration
Flask-WTF’s CSRFProtect extension signs its token using your SECRET_KEY unless a separate WTF_CSRF_SECRET_KEY is set, and it only covers the forms and views actually registered against it. We test for state-changing routes that never went through Flask-WTF, a JSON API left out of CSRF coverage entirely, and any view explicitly exempted and never revisited.
Flask-CORS Origin and Credential Configuration
Flask-CORS’ extension enables CORS support on all routes, for all origins, by default, so anything narrower has to be configured explicitly through its resources and origins options. We test the configured origins against what the application actually needs to accept requests from, and check whether a wildcard origin was ever combined with credentialed requests.
Flask-SQLAlchemy Raw Queries and Bound Parameters
Every query, ORM or raw, runs through db.session.execute(), and a call built with SQLAlchemy’s select() is parameterised automatically, while a raw SQL query built with text() stays safe only if its values are bound rather than formatted directly into the string. We test every text() call and any raw SQL built from request data for that gap, not just the ORM-built queries around it.
Debug Mode and the Werkzeug Debugger Console
Flask’s debug mode turns an unhandled exception into an interactive Werkzeug console capable of executing arbitrary code in that request’s context, held back only by a PIN that WERKZEUG_DEBUG_PIN can set explicitly or switch off entirely with the value off. We test whether debug mode is reachable from outside your network and what the console allows once an exception is triggered.
Blueprint Hooks and Per-Route Decorator Coverage
A blueprint’s before_request only runs for routes registered on that blueprint, so a route added to the wrong blueprint, or registered directly on the app instead, misses whatever authentication check the rest of the API relies on. We test every route in scope against the blueprint and decorator it should carry, including ones added after the initial build where copying a decorator is easy to miss.
File Upload Paths and Trusted Proxy Headers
secure_filename() only protects a filename you actually pass it before saving, and that same client-supplied filename should never reach send_file() or send_from_directory() unvalidated or it can walk outside the intended directory. Behind a reverse proxy, ProxyFix has to be told exactly how many proxies sit in front of the application or it will trust an X-Forwarded-For or X-Forwarded-Proto header an attacker could set themselves.
OUR PROCESS
Flask Penetration Testing: From Scope to Attestation
Scope and Test Accounts
We agree the routes, environments and a test account for every Flask-Login role or Flask-WTF form in scope, plus whether Celery workers, CLI commands or a separate frontend sit in or out of scope.
Configuration and Extension Mapping
We map SECRET_KEY handling, session cookie flags and how Flask-Login, Flask-WTF, Flask-CORS and Flask-SQLAlchemy are configured against what the application actually needs to enforce.
Hands-On Testing
A CREST-certified tester manually works through session forgery, template injection, extension configuration, debug exposure and file upload handling, chaining findings where one weakness leads to another.
Report and Retest
You receive a technical report with CVSS-scored findings and reproduction steps, a walkthrough call, a free retest once fixes are live, and an attestation letter for your auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Flask pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Flask Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Flask For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Flask Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Flask application?
We need a test account for every role or permission tier your application defines through Flask-Login or your own authentication code, including a valid session or token for each one. If routes are split across multiple blueprints with their own before_request checks, tell us during scoping so we can request access to each group rather than just the ones visible from the top-level routes.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes, outbound emails and live payment processing, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a Flask penetration test take?
A single Flask application sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. An application with more roles, a larger API surface or several integrations moves into a wider scope with more testing days.
Do you test Flask running on serverless or managed platforms as well as our own servers?
Yes. Flask is a WSGI application typically served by Gunicorn, uWSGI or a similar server, and we test it the same way whether that is on your own infrastructure, in a container, or behind a managed platform. Flask itself is framework code you deploy and control rather than a shared multi-tenant service, so there is no Flask vendor testing policy to follow; if the hosting platform has its own penetration-testing policy, we confirm it during scoping.
Should debug mode be switched off before testing?
Leave it configured however it normally runs. Testing includes checking whether debug mode and the Werkzeug console are reachable from outside your network and what they expose if triggered, rather than assuming either state is correct beforehand.
Are Celery workers or scheduled jobs behind the application in scope?
Yes, if you want them covered. They share the same models, database access and secrets as your Flask routes but sit outside any per-route decorator or blueprint check, so tell us during scoping if they should be included.
What is out of scope for a single-framework Flask test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope for this test and covered by our cloud penetration testing service instead. A separate frontend application consuming the API, such as a decoupled React or Vue app, is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant SECRET_KEY handling, blueprint decorators and raw SQLAlchemy queries alongside testing, is available if you want faster or deeper coverage of specific findings.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Flask application
Flask signs the session cookie but never encrypts it, so its holder can read every value inside. We test what it carries, the templates rendering it, and the extensions guarding it. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
