Saleor Penetration Testing
Saleor checks permissions and channels on every GraphQL request, so one loose group reaches too much. We test your groups, apps and checkout logic against what the API actually allows. CREST-certified testers, fixed price from £2,760 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Saleor sums a user’s permissions across every permission group they belong to, so membership in a single unrestricted group overrides any channel restriction another group was meant to enforce.
Why Saleor findings come from summed permissions, not a single role check
Saleor’s permission model separates data permissions, such as MANAGE_ORDERS or MANAGE_APPS, from channel permissions that can restrict a group to named storefronts or markets. A group can be marked as restricted to specific channels, but Saleor sums every permission a user holds across all the groups they belong to, so a user who also sits in a single unrestricted group gains every channel that group can reach, whatever the other group was meant to limit. We map each staff account against every group it holds and test whether that summing has widened access beyond what the org chart assumes.
A tokenCreate response looks the same whether the account logging in is a customer or a staff member. The decoded token carries only an informational is_staff claim, and Saleor resolves the caller’s actual permissions server-side on every request rather than embedding them in the token, a detail covered in Saleor’s own authentication documentation. Saleor Apps authenticate differently again, with a long-lived bearer token issued once at installation and sent as an ordinary Authorization header, so an app that should have been retired but never had its token revoked keeps working exactly as before. We test how your storefront, backend and installed apps tell these token types apart, and what each one can still do.
Where checkout runs through Saleor’s own payment API, the transaction stays inside Saleor’s flow. Where your backend instead uses the Transaction API to write orders and payments directly, for a custom flow or recurring subscription logic, that write path is only as trustworthy as the account making it. Webhook events carry a Saleor-Signature header, an HMAC computed with a shared secret, alongside headers naming the event and the originating domain, and a receiving endpoint that trusts those headers without checking the signature has no real way to know the payload came from Saleor. None of this is a flaw in Saleor itself. It is the configuration, custom code and integrations your team or your developer built on top of it, and that is what we test.
SCOPE
What we pen test on a Saleor store
Permission Groups and Channel-Restricted Access
Saleor groups staff permissions into data permissions, such as MANAGE_ORDERS, and separate channel permissions that can restrict a group to named storefronts or markets. Because permissions from every group a user belongs to are summed, membership in one unrestricted group grants every channel regardless of what other groups intended to limit, and we test whether that summing has widened anyone’s access.
GraphQL Field-Level Permission Checks
Individual fields and mutations check the caller’s permissions on each request rather than trusting a role implied by the token, since Saleor resolves permissions server-side and never embeds them in the JWT. We query the schema as each account type to find fields or mutations returning data that account’s permissions should not reach.
Customer and Staff Token Boundaries
A tokenCreate response looks identical for a customer and a staff member, carrying only an informational is_staff claim rather than any permission data, so an integration that trusts that claim instead of the operation’s actual result can be misled about who it is talking to. We test how your storefront and backend tell the two apart, including what happens if password login is switched to customers-only while a staff session is still active.
App Installation and Permission Grants
Installing an app grants it exactly the permissions listed in the appInstall mutation, drawn from its manifest, and reviewing installations in progress is limited to a staff account holding MANAGE_APPS. We check who can approve an app installation and whether an installed app still holds permissions wider than its function needs.
App Authentication Tokens
Saleor Apps authenticate with a long-lived bearer token issued once at installation or creation and sent as an ordinary Authorization header, rather than a session token that expires or rotates on its own. We test where that token is stored, whether it is scoped to only what the integration needs, and what it can still reach if the app is retired but the token is never revoked.
Webhook Endpoints and Payload Signatures
Webhook payloads carry a Saleor-Signature header, an HMAC computed with a secret known only to Saleor and your endpoint, alongside headers identifying the event and the originating domain. We review your receiving endpoint’s code to confirm it verifies that signature before acting on a payload, rather than trusting the event and domain headers on their own.
Checkout, Subscriptions and the Transactions API
Checkout can run through Saleor’s own payment API, or your backend can use the Transaction API to write orders and payment records directly, a pattern Saleor documents for custom payment flows and recurring subscription logic. We test which model your integration actually uses and whether the account making those direct writes is checked as closely as the checkout it replaces.
Payment App Integrations
Where a payment app handles the transaction on your store’s behalf, we test how it is registered, what it can write back to an order through the Transaction API, and whether a failed or repeated callback can be replayed to alter a transaction’s recorded state.
GraphQL Introspection and Query Abuse
We query your production endpoint for introspection and for deeply nested or heavily aliased queries, since a single GraphQL request can expose far more of your data model than an equivalent REST call would. Where a headless storefront or an app calls the API directly, we test its queries for the same exposure.
Saleor Cloud and Self-Hosted Boundaries
Saleor Cloud is Saleor’s own managed hosting option for the same open-source core you can self-host, so the deployment model changes what infrastructure sits outside scope but not what we test in your permission groups, apps and checkout logic. We confirm which model you run during scoping so the engagement targets your configuration rather than infrastructure Saleor operates.
OUR PROCESS
Saleor Penetration Testing: From Scope to Attestation
Scope and Permission Mapping
We agree the environments, channels and integrations in scope, and map every permission group, app installation, webhook destination and payment integration before testing begins.
Automated and Authenticated Scanning
Authenticated scanning runs against the storefront, the dashboard and each account’s actual permission group, alongside targeted checks against Saleor’s documented API behaviour.
Manual Exploitation
A CREST-certified tester manually tests permission and channel boundaries, token handling, webhook signatures and checkout logic, chaining findings where they compound across groups and integrations.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Saleor pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Saleor Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Saleor For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Saleor Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Saleor store?
A staff account in a permission group you choose, so we see the dashboard the way your team actually manages it, plus at least one customer account on the storefront. Where an app, a headless storefront or a payment integration is in scope, its own auth token comes too, scoped to the permissions that integration already holds rather than a wider account created just for us.
Does this touch our live data?
No. We test against a staging instance or a cloned copy of your catalogue, channels and customer data wherever one exists. Where only production is available, any check that could place a real order or move real payment data is agreed and scoped in advance, and read-only checks are logged as they happen.
How long does a Saleor penetration test take?
A single-platform Saleor engagement is scoped at 2 testing days as a starting point, rising with the number of channels, installed apps and payment integrations in play. Reporting and a walkthrough call follow testing, with a free retest once fixes are in.
We run Saleor Cloud. What does that leave in scope?
Saleor Cloud is Saleor’s own managed hosting option for the same open-source core, so the underlying infrastructure, scaling and platform updates sit outside a single-platform engagement whether you run Cloud or self-host it yourself. Testing concentrates on your permission groups, channels, installed apps, webhook endpoints and payment integrations, since those are configured the same way on either deployment.
What is out of scope?
Saleor’s own platform infrastructure and other tenants’ stores or data. Third-party apps you have installed are tested for what they can reach given the permissions you granted them, not audited as a vendor’s product in their own right, and any wider cloud or network review sits outside a single-platform Saleor engagement unless you scope it alongside this one.
Does Saleor have a policy on testing your own store’s security?
Saleor Commerce’s Acceptable Use Policy, which governs Saleor Cloud, prohibits probing, scanning or testing the vulnerability of a system or network, or attempting to breach security or authentication measures, without proper authorisation, and separately bars any attempt to probe or scan Saleor Commerce’s own infrastructure or another customer’s account. We confirm the current terms with you during scoping, and our testing targets your permission groups, apps and configuration rather than Saleor’s platform infrastructure.
Do you test the apps we have installed?
We test what each installed app can reach given the permissions granted to it through the appInstall process, and whether any app still holds permissions wider than its function needs. We do not audit that as a vulnerability review of the app vendor’s own code, which stays theirs to secure.
We are a developer building a Saleor app, not the merchant. Can you test that instead?
Yes. The engagement scopes the same way, against your app’s authentication token, its webhook endpoint and signature handling, and its use of the Transaction API or GraphQL mutations, using a development or sandbox instance rather than a live merchant’s data.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Saleor store or integration
Saleor checks permissions and channels on every GraphQL request, so one loose group reaches too much. We test your groups, apps and checkout logic against what the API actually allows. CREST-certified testers, fixed price from £2,760 for a 2-day single-platform scope, quoted within 24 hours.
