Penetration testing

External pen tests for automotive software.

Creative Code runs external penetration tests for web applications and APIs, with a focus on automotive: apps that dealers build themselves with AI coding tools, and the SaaS platforms automotive vendors sell to dealers. We test the way an attacker would from the internet, prove every finding with evidence, score it with CVSS, and retest after you fix it.

Book a pen testHow we work securely

Who it is for

Built for the software dealers now run on

Dealer-built and vibe coded apps

Your team built a tool with Lovable, Bolt, Cursor, Replit or Claude Code: a trade-in form, a desk tool, a service portal, a group dashboard. It works. We find out whether a stranger on the internet can read your customers' data through it.

Automotive vendor SaaS

You sell software to dealers and it holds their leads, deals, inventory or customer records. We test tenant isolation, roles, the API and the integrations, and give you a report your dealer customers and auditors will accept.

Everyone else

Web applications and APIs outside automotive get the same method and the same report.

What we test

Where automotive apps actually break

Tenant isolation

Can one dealer, store or user see or change another's leads, deals, reports or customers? We test it in both directions with separate test tenants.

Authentication and sessions

MFA, password reset, token refresh and reuse, logout and session expiry, and what an attacker can do with a stolen token.

Authorization and roles

Viewer, manager and admin roles checked on every action, including the API routes the UI never calls.

API exposure

Unauthenticated endpoints, over-returning responses, missing rate limits and data you did not mean to publish.

Secrets and configuration

Keys shipped to the browser, open storage buckets, debug endpoints, version disclosure and missing security headers.

Uploads and inputs

File uploads, injection, and content that should be rejected but is accepted and stored.

Method

How a test runs

Scope and authorization. We agree the targets, test accounts and rules of engagement in writing before any traffic is sent.

Testing. We follow the OWASP Web Security Testing Guide and the PTES sequence: reconnaissance, mapping, then credentialed grey-box testing with synthetic tenants so real customer data stays untouched.

Report. Every finding comes with request and response evidence, a CVSS v3.1 score, the business impact and a specific fix. Severity is conservative and every claim is backed by evidence.

Retest. After you deploy fixes we retest and issue an updated report with each finding's status.

Recent work

A recent engagement

In October 2026 we ran an authenticated external test of a dealer analytics SaaS platform, covering its web application and public API in production. We built two synthetic dealer tenants with four test identities and tested tenant and private-report boundaries in both directions, role permissions, report sharing, MFA, refresh-token reuse and logout. The final report and a 320-file evidence archive went into the client's SOC 2 evidence file.

Penetration testing FAQ

What is an external penetration test?+

A controlled attack on your internet-facing application and API, run from outside your network the way a real attacker would approach it. The tester tries to break authentication, cross tenant boundaries, reach data they should not see and abuse the API, then documents every finding with evidence, severity and a fix.

Who do you test for?+

Our focus is automotive: dealers and dealer groups who have built their own apps with AI coding tools, and automotive software vendors whose SaaS holds dealer and customer data. We also test web apps and APIs outside automotive.

Why test a vibe coded app?+

AI coding tools ship working features fast, and the security checks a senior engineer would add by habit are often missing: authorization on every API route, tenant scoping on every query, secrets kept out of the browser, rate limits and upload validation. Those gaps are exactly what an external test finds.

Does it count toward SOC 2 or the FTC Safeguards Rule?+

Yes. The report is written to go into a SOC 2 evidence file and vendor security reviews, and the FTC Safeguards Rule calls for annual penetration testing of systems that hold customer information, which covers most dealers and many automotive vendors.

Do you test production?+

Usually, with your written authorization, synthetic test tenants and test accounts, so no real customer data is touched. A staging mirror works too when you have one.

What do we get at the end?+

An executive summary, the scope and methodology, every finding with evidence, CVSS v3.1 score and a recommended fix, an evidence archive, and a retest of the fixes with an updated report.

How long does it take?+

A focused external test of one application and its API typically runs about a week of testing, followed by the report. Retest happens once your fixes are deployed.

Book a pen test

Related