Streamlit Application Security Review
A Streamlit script reruns for every user, and cached data can leak across sessions. We test who can reach the app, what state carries between sessions, and how uploads are handled. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
st.cache_data and st.cache_resource are shared across every user of the app calling the same function with the same arguments, unless you scope them per session. We test what actually gets cached, and whether it is scoped correctly.
Why Streamlit isolation is something your code has to enforce, not the framework
Streamlit treats each browser tab as its own session, tied to that tab’s WebSocket connection, so session_state itself does not leak between users. Caching works differently: st.cache_data and st.cache_resource are function-level caches shared across every session that calls the same function with the same arguments, so we test what a cached function actually returns and to whom.
If the app runs on Streamlit Community Cloud, access can be public, invite-only by email, or gated behind Streamlit’s own st.login authentication against an identity provider such as Google or Microsoft Entra ID. We test which of those is actually configured, and whether every page in the app checks st.user.is_logged_in rather than just the one that shows a login prompt.
st.file_uploader accepts files into the running app’s memory, st.secrets reads credentials out of a secrets.toml file that must never reach source control, and unsafe_allow_html lets a developer render raw HTML inside the page. We test what happens when each of these is fed something unexpected, from an oversized or mistyped upload to content that was meant to be read-only.
SCOPE
What we pen test on a Streamlit application
App Access and Sharing Settings
A Community Cloud app can be public, invited by email, or gated behind st.login. We test which is configured and whether it matches what you intended.
st.login Authentication Coverage
Where st.login is used against an identity provider, we test that every page checks st.user.is_logged_in rather than relying on the entry page alone.
Cached Data Shared Across Sessions
st.cache_data and st.cache_resource share results across every session calling the same function with the same arguments. We test whether personalised or sensitive data ends up returned to a different user.
Session State Isolation
session_state is tied to a single browser tab’s WebSocket connection. We test what happens on a reload or reconnect, and whether any state is rebuilt from a source that is not actually private.
File Upload Handling
st.file_uploader takes files into memory up to a configurable size limit. We test file type, size and content handling for anything the app does with the upload afterwards.
Secrets and secrets.toml Exposure
st.secrets reads credentials from a secrets.toml file that must stay out of source control and off the client. We test whether any key configured there is reachable from the running app, its logs or error output.
unsafe_allow_html Usage
unsafe_allow_html lets a developer render raw HTML through st.markdown. We test every place it is used for content that did not come from a trusted, sanitised source.
Deployed Administration and Redeploys
Community Cloud lets an app owner view, reboot or redeploy an app from a shared workspace. We test who holds that access and how a change to secrets or sharing settings actually gets made.
Self-Hosted vs Community Cloud Deployment
The same session and caching behaviour applies whether Streamlit runs on Community Cloud or your own server. We test whichever deployment you use, including any reverse proxy or authentication layer placed in front of it.
Streamlit as the Front End for AI and Data Pipelines
Streamlit commonly sits in front of an LLM call, a model or a data pipeline. Where that backend needs its own security testing, our AI penetration testing covers it.
OUR PROCESS
Streamlit Application Security Review: From Scope to Attestation
Scope and Access
We agree the URL or repository, the deployment type, Community Cloud or self-hosted, and accounts for each access tier including any st.login identity provider in use.
Cache and State Mapping
We map every st.cache_data and st.cache_resource function and session_state key against what data it holds and who can reach it.
Manual Testing
A CREST-certified tester manually tests access controls, cached-data isolation, file upload handling, secrets exposure and unsafe_allow_html usage.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Streamlit pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Streamlit Application Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Streamlit For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Streamlit Application Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Streamlit app?
We need the app URL or repository access if self-hosted, credentials for each access tier the app defines, and identity provider details if st.login is configured.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as anything that triggers a live pipeline run, and we do not run destructive tests against real data without that agreement in writing.
How long does a Streamlit security review take?
A single Streamlit app sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. An app fronting a larger data pipeline or multiple models moves into a larger scope.
Do you test Community Cloud and self-hosted deployments the same way?
Yes. The testing adapts to whichever deployment you use, including the sharing and authentication settings specific to Community Cloud or whatever access control sits in front of a self-hosted instance.
What is out of scope for a single-framework Streamlit review?
The underlying model or API the app calls, if it is a separate service, and the infrastructure hosting a self-hosted deployment are scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant caching, session and secrets-handling code alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Streamlit have a customer penetration-testing policy?
Streamlit Community Cloud is a shared hosting platform, so we confirm Streamlit’s and your identity provider’s current terms during scoping before testing begins. A self-hosted deployment is tested under your own hosting policy instead.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Streamlit application
A Streamlit script reruns for every user, and cached data can leak across sessions. We test who can reach the app, what state carries between sessions, and how uploads are handled. CREST-certified testers, fixed price from £2,950 for a 2-day single-framework scope, quoted within 24 hours.
