Symfony Penetration Testing
Symfony’s access control lives in firewalls, access_control rules and voters, and a gap in any one is enough. We test all three, plus whether debug tooling and secrets ever reach production. CREST-certified testers, fixed price from £2,560 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Voters are Symfony’s mechanism for object-level authorisation checks, called through isGranted or denyAccessUnlessGranted. We test whether every controller and API operation that should call a voter actually does.
Why Symfony findings sit in configuration, not the framework code
Symfony’s security.yaml defines firewalls for authentication boundaries and access_control rules that secure URL patterns by regular expression. We test the interaction between the two: a firewall that authenticates correctly but an access_control list with a pattern that misses a route, or a route added after the rule was written.
Where an application needs a decision finer than a URL pattern, such as whether this user can edit this specific record, Symfony’s Voter classes make that call through isGranted and denyAccessUnlessGranted. On the API side we test the Serializer’s normalisation groups for a field that ended up in a group wider than intended, exposing data a response was never meant to return.
The web profiler and its _profiler routes are wired up for the dev environment by Symfony Flex, and we test that APP_ENV is genuinely prod with no way to flip it, since the profiler discloses configuration, session data and query history if it is reachable. We also check where APP_SECRET and any values in the Symfony secrets vault end up, and that CSRF protection is not disabled on a state-changing form.
SCOPE
What we pen test on a Symfony application
Firewall and access_control Configuration
security.yaml defines authentication firewalls and access_control URL patterns. We test for a route that falls outside every pattern, or a pattern that no longer matches a route that moved.
Voter Coverage on Object Access
Voters back isGranted and denyAccessUnlessGranted for object-level checks. We test every controller action that should call one, not just the ones that already do.
Serializer Group Exposure
Normalisation groups decide which fields an API response includes. We test for a field placed in a group wider than the endpoint returning it intended.
Debug Toolbar and Profiler Exposure
The web profiler and _profiler routes are built for the dev environment. We test whether they, or the debug error pages behind them, are reachable in production.
APP_ENV and Environment Configuration
APP_ENV controls whether debug tooling and verbose error pages are active. We test what your production environment actually reports, not what the config file says it should.
APP_SECRET and the Secrets Vault
APP_SECRET and any values stored in Symfony’s secrets vault back session and CSRF token generation. We test how they reach production and who can read them.
CSRF Protection on State-Changing Forms
Symfony Forms include a CSRF token by default. We test for a form or route that disabled it, or a state-changing action that bypassed the form layer entirely.
Route and Controller Access Beyond the Firewall
A route inside an authenticated firewall is not automatically restricted to the right role. We test what an authenticated but lower-privileged user can still reach.
API Platform Security Layer
Where API Platform sits on top of Symfony, its own security attributes on resources and operations need checking separately from the base application. We test both layers.
The PHP Estate Around Symfony
Symfony applications often share a server or codebase with other PHP components. Where that estate is wider than one Symfony app, our PHP and Laravel penetration testing covers the rest of it.
OUR PROCESS
Symfony Penetration Testing: From Scope to Attestation
Scope and Access
We agree the URLs, environments and accounts for every role your firewalls and voters distinguish between, plus whether API Platform is in scope.
Configuration and Access Mapping
We map security.yaml firewalls and access_control rules, voter classes, serializer groups and the routes API Platform exposes, if used.
Manual Testing
A CREST-certified tester manually tests voter coverage, serializer group exposure, debug tooling reachability and CSRF protection, chaining findings where they compound.
Attestation and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Symfony pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Symfony Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 7 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Symfony For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Symfony Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Symfony application?
We need at least one authenticated account for every role your voters and access_control rules distinguish between, plus API documentation or a schema export if API Platform is in use.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk deletes and outbound emails, and we do not run destructive tests against real customer records without that agreement in writing.
How long does a Symfony penetration test take?
A single Symfony application sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. An application with a large API Platform surface or several bounded contexts moves into a larger scope.
Do you test API Platform as well as the base Symfony application?
Yes. Where API Platform is used, we test its own security attributes on resources and operations alongside the underlying Symfony security configuration they build on.
What is out of scope for a single-framework Symfony test?
Infrastructure-level issues in the underlying server, network or cloud configuration are out of scope and covered by our cloud penetration testing service instead. A separate frontend single-page application consuming the API is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant security.yaml, voter classes and serializer groups alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Symfony have a customer penetration-testing policy we need to follow?
Symfony is framework code you deploy and control yourself rather than a shared multi-tenant service. We confirm Symfony’s and your hosting provider’s current terms during scoping before testing begins.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Symfony application
Symfony’s access control lives in firewalls, access_control rules and voters, and a gap in any one is enough. We test all three, plus whether debug tooling and secrets ever reach production. CREST-certified testers, fixed price from £2,560 for a 2-day single-framework scope, quoted within 24 hours.
