Penva Security

BACKGROUND

Introduce your business and what you do there.

I’m the founder of Cleer Money, an Australian budgeting app that links securely to your bank and has you swipe each transaction as a need or a want so you can see where your money goes and stick to your spending targets.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with Penva Security?

We hired Penva Security to independently test the security of our iOS app and backend API before scaling up with real bank data through the Consumer Data Right. We had three goals: meet our open banking obligations, find and fix weaknesses before attackers could, and give our users and partners confidence that their banking information was handled securely.

SOLUTION

What was the scope of their involvement?

Penva Security carried out a gray-box penetration test of our iOS app and the backend API that supports it. The testing followed the OWASP Mobile Application Security standards (MASVS/MASTG) and the OWASP API Security Top 10. It covered how the app stores and transmits data, authentication and session handling, and whether one user could access another user's data through the API.

What is the team composition?

We worked with one teammate from Penva Security.

How did you come to work with Penva Security?

We found them through an online search. Their pricing fit our budget, and their scope matched exactly what we required.

What is the status of this engagement?

We worked together from August to September 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

Penva Security identified eight security findings across our app and API, each with a severity rating and clear steps to fix it. We completed the key fixes within a few weeks of receiving the report. We also received the attestation letter, and the retest confirmed the fixes we had made

How did Penva Security perform from a project management standpoint?

Penva Security delivered on time. Our experience was easy. We communicated via email and messaging apps.

What did you find most impressive about them?

Every finding came with clear, specific steps to fix it, so we could act straight away instead of decoding a report.

BACKGROUND

I am the Founder of ApprvHq

ApprvHQ is simple software for print, sign, stamp and embroidery shops to get customer sign-off on artwork — one link, no login for your customer, and a permanent record that they approved it.

OPPORTUNITY / CHALLENGE

• Greybox - OWASP compliant Web Application Penetration Test

SOLUTION

Online Search

Pricing fit our budget

2-5 Employees

We engaged Penva Security to perform an independent grey-box penetration test of ApprvHQ, our web application for proof approvals, ahead of onboarding real customer data. Scope of work: Penva assessed the application in both unauthenticated and authenticated contexts, testing across all four user roles (Owner, Admin, Designer, Viewer) and across separate tenant accounts, against a staging replica of our production environment. The work focused on the security properties that matter most for a multi-tenant SaaS handling customer data — tenant isolation, authentication and authorisation, session and token handling, the file-upload pipeline, injection and other web vulnerabilities, and PII handling — following the OWASP Web Security Testing Guide (WSTG) over an eight-day testing window. Testing was carried out by a consultant holding both OSCP and CREST certifications. Key deliverables: A detailed technical penetration test report — each finding with its severity and CVSS rating, affected component, impact, clear remediation guidance, and a fix-validation status. Retesting and confirmation of our remediations — Penva verified each fix before finalising the report. A Letter of Attestation — a concise, shareable summary of the engagement and results, suitable for providing to our own customers and partners as evidence of an independent security assessment. 

RESULTS & FEEDBACK

the assessment identified six issues (two medium, three low, one informational) — no critical or high severity. We remediated all six, and Penva confirmed every fix before the final report, which recorded an overall "Secure" posture with zero open issues. Communication was prompt and professional throughout, and the report and attestation were exactly what we needed to move forward with confidence.

The team's work was thorough and professional, and the responsive communication throughout — it made the whole process genuinely easy.

Email or Messaging App

What stood out most was the personal, direct contact throughout. I dealt with the same consultant from start to finish — communication was clear and prompt at every step, questions were answered quickly and in plain terms, and the engagement ran exactly to the timeline we'd been given: testing in the agreed window, findings shared clearly, remediation retested, and the final report and attestation delivered when they said they would. For a small team, that combination of a genuine point of contact and reliable, on-schedule delivery made the whole process easy to plan around and gave us real confidence in the results.

Nothing significant — the engagement was well run and delivered as promised. If anything, the only "next step" is on our side rather than theirs: we scoped this as a grey-box test, which was the right fit for our stage, and as we grow the natural progression is a fuller white-box code review. That's a reflection of where we are, not a shortcoming in Penva's work — they delivered exactly what was agreed, thoroughly and on time.

BACKGROUND

Please describe your company and position.

I am the Senior Software Engineer of Loop IQ

Describe what your company does in a single sentence.

Aged Care

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• GreyBox penetration test for our website to ensure security and compliance

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• High ratings
• Pricing fit our budget
• Company values aligned

How many teammates from Penva Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Penva conducted Greybox assessment of our web application, simulating real-world attacks without prior knowledge. Their final report detailed the identified vulnerabilities, assigned risk levels, and provided clear remediation steps. They further supported developers during the validation phase to ensure all issues were properly resolved.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The team provided continuous updates during the engagement and highlighted risks as they were uncovered. This allowed developers to address issues promptly, ultimately reducing the overall time needed for remediation.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

All deliverables were provided within the agreed timeline, and they were highly responsive whenever we had questions. We valued the steady communication and their willingness to address concerns as they arose.

What was your primary form of communication with Penva Security?

Virtual Meeting

What did you find most impressive or unique about this company?

The clarity and practicality of their reports were impressive, straightforward, actionable, and easy to understand. What also stood out was their collaborative approach, working alongside us instead of just submitting findings. Their openness throughout the process gave us confidence in the results.

Are there any areas for improvement or something Penva Security could have done differently?

We were very pleased with the overall experience. They went beyond standard testing by assisting with fix validation, which is not something every provider offers. At this time, we don’t have any suggestions for improvement and would gladly engage them again.

BACKGROUND

Please describe your company and position.

I am the Co-Founder of Snapshot

Describe what your company does in a single sentence.

Educational software provider

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• Black-Box Penetration test

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• High ratings
• Close to my geographic location
• Pricing fit our budget

How many teammates from Penva Security were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

We engaged Penva to conduct a black-box web application penetration test of the Snapshot Educational Solutions platform — a cloud-based school management and learning tool used by teachers, students, and parents across Australian schools.

The scope covered our production web application including authentication flows, API endpoints, client-side code, session management, input validation, and access control mechanisms. Testing was conducted remotely over a five-day period following OWASP Testing Guide methodology with CVSS 3.1 severity scoring.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The engagement delivered clear, quantifiable results within a compressed timeframe. Three vulnerabilities were identified and assessed — one medium and two low severity — with zero critical or high severity findings, validating the overall security posture of the platform.

Two of the three vulnerabilities were fully remediated within the five-day testing window, representing a 67% remediation rate during the engagement itself. Both fixes were validated by the tester and confirmed resolved in the final report.

The completed penetration test report was a contractual requirement for Snapshot's Safer Technologies for Schools (ST4S) assessment — a mandatory compliance process required by the NSW and Victorian Departments of Education prior to signing government school software panel contracts. Delivery of the report on time directly unblocked contract execution with two state education department

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The engagement was exceptionally well managed given the tight timeframe and compliance-driven deadline. The tester demonstrated strong responsiveness throughout — when vulnerabilities were identified, Snapshot's development team was notified promptly, allowing two of the three issues to be remediated and validated within the five-day testing window itself.

Communication was clear and professional throughout the engagement. Findings were explained in plain language alongside the technical detail, making it straightforward to prioritise and action remediation work without delay.

The final report was delivered on schedule, which was critical given it was a hard dependency for a government compliance process with a fixed submission deadline. The tester understood the commercial stakes and worked collaboratively to ensure we met our deadline without compromising the thoroughness of the assessment.

We would not hesitate to engage them again — both for our scheduled annual penetration testing obligations and for any future assessments required as we expand our product offering.

What was your primary form of communication with Penva Security?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

What stood out most was the tester's ability to operate effectively within the constraints of a compliance-driven engagement rather than a standard commercial pen test. This wasn't just a technical exercise — the findings needed to meet the specific evidence requirements of the Safer Technologies for Schools (ST4S) government assessment framework, and the tester understood that context without needing to be guided through it.

The collaborative approach to remediation was particularly impressive. Rather than delivering a report at the end and walking away, the tester actively communicated findings during the engagement, giving our development team the opportunity to remediate two vulnerabilities in real time and have those fixes validated before the report was finalised. That kind of responsiveness is rare.

From a technical standpoint, the breadth of coverage was thorough — authentication testing, client-side code review, session management, input validation, API endpoints, and access control were all assessed across a Flutter web application built on a serverless Firebase architecture. Testing a non-standard stack like this competently requires genuine expertise, and the quality of the findings reflected that.

Are there any areas for improvement or something Penva Security could have done differently?

None of note. The engagement delivered exactly what was scoped, on time, and with a level of collaboration that exceeded expectations. If pressed, the only observation would be that the testing was conducted against a staging environment rather than production, which is standard practice but worth noting for completeness. This had no material impact on the quality or relevance of the findings.

BACKGROUND

Please describe your company and position.

 I am the Partner & Chief Product Officer of a software company 

Describe what your company does in a single sentence.

Venture building services for startups, scaleups and corporates.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• Penetration Test of web application
• Penetration Test of mobile application
• Executive level report on identified vulnerabilities and current status.

SOLUTION

How did you find Penva Security?

Referral

Why did you select Penva Security over others?

• Close to my geographic location
• Pricing fit our budget
• Good value for cost
• Referred to me

How many teammates from Penva Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Work included critical vulnerabilities testing of the biggest risks to the web and mobile applications (e.g. database injections, server-side attacks, critical logic flaws)

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

• Google Sheet deliverable to present identified web application vulnerabilities and support collaboration with Future Golf development team to address identified vulnerabilities
• Google Sheet deliverable to present identified mobile application vulnerabilities and support collaboration with Future Golf development team to address identified vulnerabilities
• Detailed professional report outlining overall findings, risk assessments, and status of remediation steps

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Penva Security managed the project very professionally. Their proactivity and communication was excellent. They were flexible and willing to adapt if needed for the good of the project.

What was your primary form of communication with Penva Security?

Email or Messaging App

What did you find most impressive or unique about this company?

The testers from Penva Security are as strong in communication and collaboration as they are in technical expertise. This is rare to find.

Are there any areas for improvement or something Penva Security could have done differently?

Penva Security could not have done anything better or differently. The key limitation in our project was the speed of developers to resolve issues, however Penva was proactive in following up and pushing for timely resolutions. 

BACKGROUND

Please describe your company and position.

I am the Managing Director of Northbase

Describe what your company does in a single sentence.

Web build websites and web applications.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• To provide thorough penetration testing for a varity of public and private applications for our clients

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• Close to my geographic location
• Great culture fit
• Company values aligned
• Great Communication

How many teammates from Penva Security were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

We had 4 customer applications, some with public facing entry points, some just as internal applications, that required extensive penetration testing. We were looking for someone to simulate real world hacking attempts, whilst also providing guidance and knowledge for our development team. Our key deliverables were:

• comprehensive penetration testing of public and private endpoints
• knowlege transfer to our development team
• development guidance and retesting through to completion

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Success for us was actually finding vulnerabilities in our applications. we are under no illusion that app development is perfect out of the box. So we actually wanted issues to be found.

From here, Penva was fantastic in providing detailed feedback as to the issues, and working with the development team to rectify and patch.

The key success metric was patching all found vulnerabilities.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Penva was ahead of the game. Really proactive, and delivered on time and on budget for the required tasks.

What was your primary form of communication with Penva Security?

• In-Person Meeting
• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Penva Security was extremely easy to talk to about a topic that was outside our skill set. We wanted someone that would work with us, and understand where we had come from in the area of security as well. We wanted a team mate, and thats what we got.

Are there any areas for improvement or something Penva Security could have done differently?

Not really no, the team at Penva were professional and detailed at all times. 

BACKGROUND

Please describe your company and position.

 I am the CTO of an energy & natural resources company 

Describe what your company does in a single sentence.

Energy accounts and asset management platform

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• Third party web app penetration testing; blackbox penetration test and meet compliance and security requirements.

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• High ratings
• Pricing fit our budget
• Good value for cost

How many teammates from Penva Security were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

To perform a blackbox penetration test and meet compliance and security requirements

Penva Security conducted a blackbox penetration test of web application, focusing on identifying security vulnerabilities without prior access. Penva Security provided a detailed report with technical findings, risk ratings, and remediation guidance. Penva Security also supported the team during the fix verification process to ensure all issues were addressed effectively

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Black box penetration test results report. This was delivered promptly, and some vulnerabilities were uncovered.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Very reponsive on email. Worked quickly and delivered a concise report with solid findings. Appreciate the efficiency and speed.

What was your primary form of communication with Penva Security?

Email or Messaging App

What did you find most impressive or unique about this company?

Very communicative, worked promptly, and devoted all their attention to our project during our engagement. This is a refreshing experience.

Are there any areas for improvement or something Penva Security could have done differently?

Penva Security went beyond just delivering a report. They provided hands-on support during remediation and maintained a high level of professionalism throughout. They are our first choice for a white-box penetration test in a few months; I expect an ongoing relationship

BACKGROUND

Please describe your company and position.

I am the General Manager of Sreams

Describe what your company does in a single sentence.

We build data analytics software designed to help schools track and improve student performance.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• We engaged Penva Security to conduct a thorough penetration test on our Student Performance Analytics Platform, which is used by school staff. The goal was to ensure the platform met security standards required for an upcoming audit.

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• Pricing fit our budget
• Company values aligned

How many teammates from Penva Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

The scope included a complete gray-box penetration test of our application, which has a wide range of features and user roles. Penva Security provided a detailed assessment, identifying vulnerabilities and helping us prepare for a successful audit. A comprehensive report with clear remediation steps was part of the final deliverables.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Success was measured by how well the platform met audit requirements, how quickly and clearly vulnerabilities were identified, and how effectively we could fix them.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Penva Security was very responsive and punctual. They met all deadlines, provided regular updates, and were quick to answer our questions or concerns. Their approach to project management felt very collaborative and dependable.

What was your primary form of communication with Penva Security?

Virtual Meeting

What did you find most impressive or unique about this company?

What stood out the most was their consistent communication and willingness to explain each issue clearly. They worked closely with our developers and were transparent about every test case they executed. Their practical guidance made the remediation process much more manageable.

Are there any areas for improvement or something Penva Security could have done differently?

We were very satisfied with their work. Penva Security not only delivered a detailed report but also went the extra mile to guide us through fixing the issues. We’d be happy to work with them again in the future.

BACKGROUND

Please describe your company and position.

I'm an executive at Innovae Pty Ltd

Describe what your company does in a single sentence.

A mobile first application to help SMBE's and trades manage contracts and agreements.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• Ensure the Android and iOS plaform for the App was safe and secure for customers to use
• Highlight and unknown risks and remediate any findings.

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

• High ratings
• Pricing fit our budget
• Met our objectives and goals for outcomes

How many teammates from Penva Security were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

Scope of work

• Third-party penetration test of Contractual, a mobile-first contract management app, ahead of first public release
• Engagement confirmed 24 July 2026; testing window 29 July – 6 August 2026 (8 business days — 7 testing, 1 reporting)
• Scope covered three surfaces: the Android app, the iOS app, and the backing staging API. Our marketing site was explicitly out of scope for this round
• Black-box, remote, testing both unauthenticated and authenticated paths against a tester account we provisioned
• Methodology: OWASP MASTG / MASVS (aligned to L1 and L2), OWASP API Security Top 10, PTES, and NIST SP 800-115, with CVSS v3.1 scoring — manual-led rather than scanner-driven
• A full retest of all remediated findings was included in the original fixed price, not quoted as an extra

Key deliverables

• A live test-case tracking sheet maintained during the testing window, so we could see coverage as it happened rather than waiting for the report
• 9 findings — 1 High, 2 Medium, 6 Informational, with zero Critical. Each carried a CVSS v3.1 score, reproduction detail and remediation guidance
• Penva proposed holding the report until after remediation so it would reflect the final state of the product rather than a snapshot we'd already moved past — that was their suggestion, and it produced a far more useful document
• Full fix validation on retest, with a per-finding status against our remediated build
• Final report delivered 28 August 2026: zero Critical, and zero open High, Medium or Low

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Measurable outcomes

• Baseline established: 9 findings — 1 High, 2 Medium, 6 Informational, with zero Critical across the Android app, the iOS app and the backing API
• 6 of 9 findings closed and independently re-verified by Penva on retest
• Zero open High, Medium or Low findings at report. The 3 remaining items are Informational and were formally accepted by us as ongoing risk, with documented compensating controls
• Highest-severity finding — closed and confirmed fixed on retest
• Remediation turnaround of 7 days: final findings received 10 August, remediated build delivered back to Penva 17 August
• Delivered on the original fixed price with no variations or change orders — the retest was included as quoted
• The engagement changed how we rate our own issues, not just our code: the High was a composition of two problems we had already logged separately and rated lower priority. Penva proved they chained. That re-rating is the single most valuable thing we took out of the test
• The report and our written risk-acceptance record now serve as third-party security evidence
• We've since adopted a standing pen-test cadence off the back of it — every 12 months, or on each major version change, whichever comes first

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Penva's project management was true to their communication. They kept us up to date with progress and communicated clearly any findings as they went.

All items were delivered on time and as described.

They were responsive to our questions and flexible on our remediation schedule. 

What was your primary form of communication with Penva Security?

Email or Messaging App

What did you find most impressive or unique about this company?

The most impresive and unique facet of Penva was a 1:1 communication directly with the testing engineer. No misscommunication and or indirect loss in the project outcome. Their pricing schedule was exactly what we needed to kick things off for a new App build. 

Are there any areas for improvement or something Penva Security could have done differently?

There is no area of improvement that come to mind when reviewing our engagement with Penva.

BACKGROUND

Please describe your company and position.

 I am the Founder of a software company 

Describe what your company does in a single sentence.

Management software for restaurants.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Penva Security to accomplish?

• Pentest

SOLUTION

How did you find Penva Security?

Online Search

Why did you select Penva Security over others?

High ratings

How many teammates from Penva Security were assigned to this project?

1 Employee

Describe the scope of work in detail. Please include a summary of key deliverables.

They helped us to perform a pentest and through this proccess we discovered several vulnerabilities and were able to fix them.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Number of vulnerabilities identified 

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Work was delivered on time and in a clear and structured fashion. 

What was your primary form of communication with Penva Security?

Email or Messaging App

What did you find most impressive or unique about this company?

Their competence and experience were impressive.

Are there any areas for improvement or something Penva Security could have done differently?

Not that I can think of.