Storyblok Integration Security Review
Whichever access token sits in your frontend code decides whether it can read draft content as easily as published content. We test your tokens, roles, webhooks and asset access, not Storyblok’s platform. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
A Preview token returns draft and published content together from the Content Delivery API; a Public token returns published content only. Which one ends up in your production frontend decides what an outsider can read.
Why Storyblok gaps sit in your tokens and roles, not the platform
Storyblok’s Content Delivery API separates draft and published content behind different access tokens: a Public token returns published content only and belongs in production, while a Preview token returns draft and published content together and is meant for the Visual Editor or a staging build. Storyblok’s own documentation also sets out an Asset token for private files and a Release token tied to a specific release on top of these, and we test which of these tokens actually ships in your frontend bundle against what it was meant to reach.
Space access sits in two more layers. Editors work under Admin, Editor or Owner by default, or a custom role with its own allowlist or denylist across stories, folders, blocks, block fields, datasources and asset folders, and the Management API accepts either a personal access token, scoped to some or all of the spaces you own, or an OAuth token issued to a Tool Plugin or Space Plugin and limited to the space and scopes it was granted. We test what every role, personal access token and plugin grant actually reaches against the job it does.
The rest of the integration sits outside Storyblok’s own account settings. The Visual Editor loads your preview page in an iframe and appends a validation token, built from the space ID, a timestamp and the preview token, to the URL, a webhook receiver is meant to check the webhook-signature header against a secret before acting on a payload, and a private asset is only meant to resolve for a caller holding an Asset-type token. We test your space configuration, your webhook receivers and the integration code that ties a headless CMS together, not Storyblok’s hosted platform.
SCOPE
What we pen test on a Storyblok integration
Public and Preview Access Tokens
A Public token returns only published content from the Content Delivery API and belongs in a production frontend, while a Preview token returns draft and published content together and is meant for the Visual Editor or a staging build. We test which token variable actually ships in your production bundle, since a Preview token exposed there hands every visitor the same draft access your editors get.
Draft and Unpublished Content Reachability
Any request made with a valid Preview token returns a story’s draft version alongside anything already published, so a page still in review, an embargoed release or a slug nobody has linked to yet is reachable the moment that token exists anywhere it shouldn’t. We test what draft content each token, route and cached response actually returns against what your site is meant to show.
Management API Personal Access Tokens
A personal access token is account-specific and defaults to All spaces, every space you own, unless it is deliberately restricted to selected spaces and specific scopes such as Stories, Assets, Users or Webhooks, and a Full user permission token carries no space or scope restriction at all. We test every live personal access token’s actual scope against the integration it was issued for.
OAuth Tokens for Tool and Space Plugins
Tool Plugins and Space Plugins authenticate to the Management API with an OAuth token issued on a user’s behalf, valid only within the space and scopes it was granted rather than across the whole account. We review any custom plugin your team has built or installed for what its OAuth grant can actually reach.
Default Roles: Admin, Editor and Owner
Admin, Editor and Owner ship with fixed permissions that cannot be edited. Editor manages content, assets and tags and can view datasources, Admin extends that to users and apps, and Owner adds subscription management and the ability to grant Admin or Editor access to others. We test that everyone assigned one of these roles is reaching only what that role is meant to cover.
Custom Roles and Permission Allowlists
Custom roles set granular permissions across stories, folders, blocks, block fields, datasources and asset folders, each using an allowlist or denylist that defaults to allowed unless a restriction is deliberately added. We test whether every custom role in your space was actually locked down to the content and blocks it needs, or still carries the wide-open access it started with.
Visual Editor Bridge and Preview URLs
The Visual Editor loads your configured Preview URL inside an iframe and appends a validation token, built from the space ID, a timestamp and the preview access token, to the page URL every time it renders a draft. We test how your front end handles that URL and token, and whether the same pattern can be replayed outside the editor to reach draft content.
Webhook Receivers and Signature Verification
Every webhook request carries a webhook-signature header that your endpoint is meant to validate against the secret set when the webhook was created, though webhook secrets require a paid plan and task-based webhooks skip that header in favour of a manual key in the request. We test whether your receiver actually checks that signature before acting on a story published, unpublished, deleted or moved event, or accepts any POST that arrives.
Private Asset Access and Signed URLs
An asset marked private is hidden from the asset library and is only meant to resolve through the Content Delivery API for a caller holding an Asset-type token, which exchanges a filename for a signed URL. We test whether assets marked private stay unreachable through a cached CDN path, a shared asset URL or a token carrying broader access than the folder needs.
Fully Hosted APIs and Your Integration Code
Every space’s Content Delivery and Management API traffic runs through infrastructure Storyblok operates itself, pinned to one of its regional endpoints across the EU, US, Canada, Australia or China. We review the frontend and backend integration code your team built to consume those APIs, your framework, its token handling and how it renders content, not Storyblok’s hosting infrastructure.
OUR PROCESS
Storyblok Integration Security Review: From Scope to Attestation
Scope and Token Mapping
We agree the environments, spaces and roles in scope, and map every access token, custom role, webhook and plugin configured in the integration before testing begins.
Role and Token Boundary Testing
Authenticated and unauthenticated checks across every role and access token type, Public and Preview included, plus targeted checks against the permission tabs configured for each custom role.
Manual Exploitation
A CREST-certified tester manually tests token scope, permission boundaries, webhook signature verification and the custom plugins or integration code built on top of Storyblok, chaining findings where they compound.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Storyblok pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Storyblok Integration Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Storyblok For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Storyblok Integration Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Storyblok integration?
An editor-level account on a role you control, so we see the same permission structure your team manages day to day, plus a Preview access token so we can compare what draft and published content each role can reach. Visibility of the front-end code that consumes the Content Delivery and Management APIs, and of any webhook receivers or custom plugins, speeds up coverage but is not required for black-box testing.
Does this touch our live data?
No. We test against a staging space or a cloned copy of your content wherever one exists. Where only production is available, any check that could publish, unpublish or delete a story is agreed and scoped in advance, and read-only checks are logged as they happen.
How long does a Storyblok security review take?
A single-platform Storyblok engagement is scoped at 2 testing days as a starting point, rising with the number of roles, access tokens, webhooks and custom plugins in the integration. Reporting and a walkthrough call follow testing, with a free retest once fixes are in.
Is Storyblok tested differently depending on how it is hosted?
No separate self-hosted deployment exists to compare against. Every space runs on infrastructure Storyblok operates and pins to a region it manages, EU, US, Canada, Australia or China, so testing concentrates on your space configuration: roles, access tokens, webhooks, private assets and the front-end integration code your team built, never Storyblok’s hosting infrastructure.
What is out of scope?
The Storyblok platform itself, its hosting infrastructure and the underlying Content Delivery and Management API services, since that is Storyblok’s to secure rather than something your configuration changes. Third-party apps and plugins from the Storyblok marketplace that you have not customised, unless you scope a wider review alongside it.
Does Storyblok have a policy for reporting security issues?
Storyblok states that it runs its own internal and third-party penetration testing and vulnerability management programme to secure its hosted platform. That covers Storyblok’s own infrastructure, not the roles, tokens, webhooks and integration code you have configured, which is what this engagement tests. We confirm Storyblok’s current customer-testing terms with you during scoping before any testing starts.
Do you test our custom plugins and front-end integration, or just the space configuration?
Both. We test the roles, access tokens, permissions and webhook configuration inside your Storyblok space, and the custom Tool Plugins, Space Plugins or front-end integration code, Next.js, Nuxt or another framework, your team has built to consume the Content Delivery and Management APIs.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Storyblok integration
Whichever access token sits in your frontend code decides whether it can read draft content as easily as published content. We test your tokens, roles, webhooks and asset access, not Storyblok’s platform. CREST-certified testers, fixed price from £2,540 for a 2-day single-platform scope, quoted within 24 hours.
