SAP Commerce Cloud Penetration Testing
SAP Commerce Cloud stores payment integration secrets as files on disk, not in a settings screen. We test how those files, your impex imports and custom checkout code are protected. CREST-certified testers, fixed price from £4,180 for a 3-day single-application scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
SAP Commerce Cloud configuration, including enabling the Open Payment Framework on a basestore, is deployed by running an impex import script rather than through a settings screen. We test what an impex import is allowed to change and who in your team or supply chain can run one.
Why SAP Commerce Cloud findings sit in your configuration and customisation, not the platform
SAP’s own Open Payment Framework integration ships as a B2C addon, a separate B2B addon, and a core extension, and it requires two independent OAuth-secured connections: one to the Cloud Connector adapter and one to the OPF payment gateway itself, each with its own client ID and secret. We test both integration points separately, since a credential valid for one is not meant to work against the other.
Rather than storing those OAuth credentials in a settings screen, SAP’s own setup instructions have the client ID and secret for each connection saved as separate text files in a security configuration folder, referenced from application properties by filename and by a file location such as the platform’s config directory. We test how those files are protected on the deployed instance and whether they are ever exposed through a backup, a log, or a misconfigured file permission.
Enabling the payment framework on a basestore is done by running an impex import script, and SAP’s sample tax and shipping calculation code for the integration is delivered with its values defaulted to zero pending a custom implementation. We test what an impex import in your environment is actually allowed to change, and whether your team’s custom order, tax or shipping calculation code can be manipulated to alter what a customer is charged.
SCOPE
What we pen test on a SAP Commerce Cloud application
OAuth Credentials for the Cloud Connector Adapter
The Cloud Connector adapter authenticates through its own OAuth client ID and secret, separate from the payment gateway connection. We test whether that credential is scoped only to the adapter it belongs to.
OAuth Credentials for the Payment Gateway
The Open Payment Framework gateway connection uses its own OAuth client ID and secret, distinct from the Cloud Connector’s. We test whether the two credential pairs are actually kept separate in practice.
Secret File Storage and Deployment Handling
OAuth client secrets for the payment integration are stored as text files in a security configuration folder rather than a database or vault. We test how those files reach the deployed instance and who or what can read them.
Impex Import Boundary and Basestore Configuration
Enabling the payment framework, and much of the platform’s own configuration, is done through impex import scripts. We test what an import is allowed to change and whether that boundary is enforced outside the intended deployment pipeline.
Custom Order, Tax and Shipping Calculation
SAP’s own sample payment integration code delivers tax and shipping fee calculation with values defaulted to zero, pending a custom implementation. We test your team’s actual implementation for a value that can be manipulated to change what a customer is charged.
B2C Versus B2B Accelerator Configuration
The payment framework, and much of SAP Commerce Cloud’s accelerator storefront, ships as separate B2C and B2B addons. We test each deployed accelerator on its own terms rather than assuming one inherits the other’s controls.
Backoffice Admin Console Access
The Backoffice console is where administrators manage catalogues, orders, promotions and users. We test which Backoffice roles exist in your instance and whether any reaches further than its job requires.
Custom Multi-Step Checkout Flow
The payment framework introduces its own multi-step checkout configuration into the storefront. We test that flow for a step that trusts a value from an earlier step instead of re-validating it server-side.
Order Management Integration
Order data can flow to SAP’s own order management or to an asynchronous order management setup depending on how the integration is configured. We test what that integration trusts from the storefront before it acts on an order.
Custom Extension and Addon Review
Extensions and addons are installed directly into the accelerator storefront’s core-customize folder. We test what a custom extension or addon can reach beyond the feature it was built to add.
OUR PROCESS
SAP Commerce Cloud Application Penetration Testing: From Scope to Attestation
Scope and Access
We agree which extensions, addons and integrations are in scope and get Backoffice and storefront test accounts for your instance.
Application Testing
CREST-certified testers work through OAuth credential handling, impex boundaries and custom checkout code against the rows above.
Findings and Retest
Findings are written against the specific extension, credential or import involved, with a free retest once you have fixed them.
Report and Sign-off
You get a report ready to hand to an auditor or your own engineering team, plus a fixed retest window until every finding is closed.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST SAP Commerce Cloud pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent SAP Commerce Cloud Application Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 5 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote7 to 9 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test SAP Commerce Cloud For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From SAP Commerce Cloud Application Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our SAP Commerce Cloud application?
A Backoffice test account, storefront test accounts for your B2C or B2B accelerator, and visibility of any custom extension or addon your team built. We do not need production OAuth client secrets.
Does testing touch live customer or order data?
We work against a staging or test instance wherever your setup allows it, and agree with you during scoping how to handle anything that can only be tested against a production environment.
Do you test SAP’s own platform or our implementation?
Your implementation: the extensions, addons, impex configuration and custom checkout code your team or implementation partner built. SAP’s own Commerce Cloud platform code is not something we test.
What is out of scope?
SAP’s underlying Commerce Cloud hosting and infrastructure, and any extension or addon not included in the agreed scope.
How long does a SAP Commerce Cloud review take?
A single application with a typical set of extensions and one accelerator storefront is usually a 3-day scope. Both B2C and B2B accelerators, or heavy custom integration, usually need more, which we confirm during scoping.
Does SAP have a vendor testing or disclosure policy?
We confirm SAP’s current terms for security testing directly with you during scoping, since these depend on your specific contract and can change.
Can you test our B2B accelerator separately from B2C?
Yes. Each accelerator storefront and its addons are tested on their own terms, since the B2B and B2C integrations are delivered as separate components.
Do you need our OAuth client secrets?
No. Test credentials issued for the engagement, scoped the same way as your production ones, are enough.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your SAP Commerce Cloud application
SAP Commerce Cloud stores payment integration secrets as files on disk, not in a settings screen. We test how those files, your impex imports and custom checkout code are protected. CREST-certified testers, fixed price from £4,180 for a 3-day single-application scope, quoted within 24 hours.
