Render Deployment Security Review
Every Render service, preview and background worker draws from the same environment variables, secret files and environment groups someone in your workspace configured. We test what was actually set, not Render’s platform. CREST-certified testers, fixed price from £2,320 for a 2-day single-workspace scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
A Render workspace assigns each member one of five roles, Admin, Developer, Contributor, Viewer or Billing, and only two of them, Admin and Developer, can see values like environment variables and connection strings at all.
A Render workspace is only as secure as the roles, environment groups and network rules your team configured
Render workspace members hold one of five roles, and the difference between them is not cosmetic: an Admin or Developer can see environment variables, connection strings and secret files, while a Contributor, Viewer or Billing member is explicitly blocked from all three, according to Render’s own role documentation. An environment group compounds that decision by sharing the same variables and secret files across every service linked to it, and Render does not guarantee which value wins when two linked groups define the same one, only that a service’s own setting always beats a linked group’s.
A preview environment spins up a separate, temporary deployment for a pull request, and by default a secret value marked sync: false in your Blueprint is not copied into it, so a team that wants production-like data in preview has to share it deliberately through its own environment group. Datastores default in opposite directions: a Render Postgres instance accepts connections from any IP address until you narrow its allow list, while a Render Key Value instance accepts none at all until you explicitly widen it, and a render.yaml file checked into your repository can set either.
We test the workspace you actually run: the roles and API keys issued, the environment variables, secret files and environment groups configured, the IP allow lists on your Render Postgres and Key Value instances, and the deploy hooks and Blueprints wired into your pipeline. We never test Render’s own infrastructure, in the same way we test client configuration on Heroku apps rather than Heroku’s platform.
SCOPE
What we review in a Render workspace
Service Exposure: Web Services, Private Services and Background Workers
Render private services are reachable only by other services on the same private network and never receive a public onrender.com subdomain, unlike a web service, which gets one and answers requests from the internet, while a background worker is a distinct service type built for a process that takes no incoming traffic at all. We test whether every service that should be private actually is, and whether a background worker or private service has been left listening on a port it does not need.
Environment Variables and Secret Files
A secret file uploaded to a service is written to a fixed path under /etc/secrets/ at runtime, with the combined size of every secret file on a service or environment group capped at 1MB, and a non-Docker service also gets a copy in its project root. We test who can reach that filesystem, which values sit in plain environment variables rather than secret files, and whether a build or deploy log has ever printed one.
Environment Groups Shared Across Services
An environment group bundles environment variables and secret files so several services can share them, and Render does not guarantee which value wins when two linked groups define the same variable, currently falling back to whichever group was created most recently, though a service’s own individually set variable always takes precedence over any linked group. We test which services share a group they should not, and whether a variable a developer expects to be overridden by a group is actually the one being served.
Preview Environments and Pull Request Previews
A preview environment is a separate, temporary deployment created for a pull request, and any environment variable set with sync: false in the Blueprint is not copied into it by default, so a team wanting production-like secrets in preview has to share them deliberately through a manually created environment group. We test whether that deliberate sharing has happened, and whether a preview deployment is reachable by anyone who should not see it.
Render Postgres: External Access and IP Allow Lists
A Render Postgres instance is reachable from any IP address by default whenever a connection uses valid credentials over its external URL, and the IP allow list that restricts this defaults to 0.0.0.0/0 until you narrow it, while a same-region Render service can always reach it over the internal URL regardless of that list. We test what the allow list actually contains, and whether a database still accepts connections from anywhere when only your own services should reach it.
Render Key Value: External Access and IP Allow Lists
A Render Key Value instance is the opposite of a fresh Postgres database: it is not reachable at its external URL at all until you explicitly grant access to specific IP address blocks, and a Blueprint that wants external access must define that allow list itself. We test whether external access was switched on for a reason that still applies, and what the allow list actually contains against it.
Team Roles and Workspace Access
A Render workspace assigns each member one of five roles: Admin has full access including member and billing management, Developer reaches services and environment groups but not organisation settings, Contributor cannot view connection strings, environment variables or billing information, Viewer is read-only, and Billing reaches only billing settings, with an Admin able to mark individual environments as protected to restrict the rest. We test which role every member actually holds against what their work needs, and whether a Contributor or Viewer login can still reach a value it should not.
API Keys
Every Render API request authenticates with an API key created from an individual’s Account Settings page and shown in full only once, so a key belongs to the person who made it rather than to the workspace itself. We test which keys are still active, what each one can reach through the account that issued it, and whether an old key has ever been logged or committed.
Deploy Hooks
Every service gets its own secret deploy hook URL, and a plain GET or POST request to it, no headers or authentication required, starts a new deploy, which is why Render’s own guidance is to treat the URL as a secret and regenerate it if it is ever exposed. We test where a deploy hook URL has been shared, whether it appears in a CI log, script or third-party integration, and what triggering it can actually do to your environment.
Blueprints (render.yaml) in Your Repository
A Blueprint’s render.yaml file defines every service, database and environment group as code, and Render’s own guidance is not to hardcode a secret value in it, using a sync: false placeholder that is filled in through the Dashboard instead, while the ipAllowList field is optional for a Postgres database but required for a Key Value instance. We test what a committed render.yaml actually reveals, whether a sync: false placeholder was ever replaced with a real value, and whether the ipAllowList in the repository matches what is deployed.
OUR PROCESS
Render Deployment Security Review: From Scope to Attestation
Scope and Access
We agree which Render workspace, services, datastores and preview environments are in scope, plus at least one login for each team role in use.
Configuration and Role Mapping
We map every workspace role, environment group, IP allow list and deploy hook against what it actually grants before testing begins.
Manual Testing
A CREST-certified tester manually tests service exposure, secret handling, preview environments and datastore access controls, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Render pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Render Deployment Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Render For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Render Deployment Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Render workspace?
We need a login with the Admin or Developer role rather than Contributor or Viewer, since those roles cannot see connection strings, environment variables or billing information, plus visibility of your current services, environment groups and IP allow lists. An API key scoped to the workspace speeds up several checks but is not required to start.
Will testing touch our live data?
Testing focuses on roles, environment variables, secret files, environment groups, preview environments and IP allow lists rather than the contents of your Render Postgres or Key Value data. Where proving a finding needs a test record, we agree the exact scope with you first and remove anything we create once testing is complete.
Is this hosted on our infrastructure or Render’s?
Your services, databases and Key Value instances all run on Render’s infrastructure, so there is nothing separate for you to host. The review is scoped to the workspace configuration you control: roles, environment variables, environment groups, preview environments and network access, not to Render’s own platform.
How long does a Render security review take?
A single workspace with a typical number of services, one Render Postgres instance and a handful of environment groups sits in our 2-day single-workspace scope, with a report usually landing around 5 working days after kickoff. A workspace running several datastores, multiple environments or a large number of preview deployments extends that scope.
What is out of scope for a single-workspace review?
Testing Render’s own infrastructure or shared platform is never in scope, and we do not run denial-of-service testing against any Render service. The application code running inside a web service or background worker is scoped and quoted separately from the workspace and configuration review.
Does Render have a customer penetration-testing policy we need to follow?
Render does not publish a dedicated penetration-testing policy setting out notification steps or rules of engagement in the way some other providers do; its published position is an Acceptable Use Policy alongside an abuse-reporting address for the platform generally. We confirm Render’s current terms and any workspace-specific conditions during scoping before testing begins.
Do you need our source code or standing admin access?
No. We test with the role-based access and login you provide, and we do not need standing Admin access beyond what is needed to verify a specific finding during the engagement. Source code for a Blueprint or an application deployed on Render is only needed if you commission that code as a separate assessment.
Are your testers CREST certified?
Yes. Every Render engagement is carried out by UK-based, CREST-certified testers, and your report and attestation letter are recognised by auditors and insurers accordingly.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Render workspace
Every Render service, preview and background worker draws from the same environment variables, secret files and environment groups someone in your workspace configured. We test what was actually set, not Render’s platform. CREST-certified testers, fixed price from £2,320 for a 2-day single-workspace scope, quoted within 24 hours.
