Lumina
Sign inStart a test

Find the holes before someone else does.

Lumina runs in-depth penetration tests on your web apps and APIs, logged in as each of your user roles, and gives you a report your engineers can act on the same day.

Start a testRead a sample finding
GET /api/v2/invoices/48213 HTTP/1.1
Host: app.example.com
Authorization: Bearer eyJhbGciOiJI…  (viewer@acme.test)
 
HTTP/1.1 200 OK
Content-Type: application/json
 
{
  "id": 48213,
  "tenant": "northwind",
  "billing_email": "finance@northwind.test",
  "total": 18400.00
}
HighBroken access control. A read-only user at one company can open any other company's invoice by changing the number in the URL.

Made in the EU. Your data stays in the EU.

Hosted on ISO 27001-certified infrastructure

  • Made in the EU

    Designed and built in Europe.

  • Running in the EU

    The platform, the testing infrastructure and our AI run in Paris, France.

  • Your data stays in the EU

    Your data is stored and processed in the EU.

How it works

From sign-up to first findings without a scoping call, a statement of work or a two-week wait for a tester.

  1. Configure your test

    Verify your domains, list the URLs, upload your OpenAPI or Postman files, and add a few test accounts with different roles. Sign the authorization and pick a depth.

  2. We attack the entire surface

    Our state-of-the-art model and testing harness work through every URL, endpoint and role you put in scope, and chain what they find the way a real attacker would.

  3. Read the report

    Each finding comes with its impact, the exact request that reproduces it, and how to fix it. Hand it straight to the engineer who owns the code.

What we test

Lumina uses autonomous testing agents that work the way an experienced tester does: map the application, form a hypothesis, try it, and only report what they could actually reproduce.

Access control between users
Can one role read or change what belongs to another role, or to another customer entirely? We log in as each test account you give us and try.
APIs, from your own specs
We read your OpenAPI or Postman collections so rarely used endpoints, optional parameters and old versions get tested too.
Injection
SQL, NoSQL, command and template injection, server-side request forgery, and cross-site scripting in every input we can reach.
Authentication and sessions
Login, password reset, token handling and session expiry, including the flows people forget to harden.
Business logic
Negative quantities, skipped steps, replayed requests and race conditions: the bugs scanners miss because nothing looks malformed.
Configuration and exposure
Debug endpoints, verbose errors, permissive CORS, missing security headers and files that should never have been public.

A finding, as you'd receive it

No scanner noise and no wall of informational warnings. Each finding says what is wrong, why it matters to your business, how to see it yourself and what to change.

This example is illustrative; it is not from a customer.

High

Invoices from other customers can be read by changing the ID

Endpoint
GET /api/v2/invoices/{id}
Weakness
CWE-639, authorization bypass through a user-controlled key

Impact

Any signed-in user, including a read-only viewer, can download every invoice on the platform, with customer names, billing emails and amounts.

Reproduce it

Sign in as the viewer test account for Acme and request an invoice ID that belongs to a different company:

curl https://app.example.com/api/v2/invoices/48213 \
  -H "Authorization: Bearer $VIEWER_TOKEN"

HTTP/1.1 200 OK
{"id": 48213, "tenant": "northwind", ...}

Fix

Load the invoice through the signed-in user's tenant, for example Invoice.where(tenant: current_tenant).find(id), and return 404 when it doesn't match. Add a test that requests another tenant's invoice.

Careful with your systems and your data

A penetration test needs real access. Here is exactly what we ask for and what we do with it.

Verified domains only

Every target must sit on a domain you have proven you control with a DNS record. Nobody can use Lumina to test someone else's site.

Signed authorization for every test

Each test starts with an explicit authorization, signed by name and recorded with the time it was given.

Test credentials that don't linger

Passwords for your test accounts are encrypted on arrival and deleted when the test ends, along with any API specifications you uploaded.

Stored and processed in the EU

The platform, the testing infrastructure and our AI run in Paris, France. Your data is stored and processed in the EU.

Your data never trains our AI

Our AI runs in the EU, and your data and code are never used to train it.

ISO 27001-certified infrastructure

Lumina is hosted on infrastructure certified to ISO 27001, the international standard for information security management.

Choose how deep to go

Pick a depth for each test. You can run a quick check today and a deep test before your next audit.

Quick

Before a release, or as a regular check-up.

Covers the most common and most damaging issues. Usually done within about an hour.

Standard

For most applications, most of the time.

A full pass over the OWASP Top 10 across every target and role you provide.

Deep

Before an audit, a launch, or a big customer's security review.

Thorough testing that follows each lead as far as it goes. Can take several hours.

Questions

Should I point Lumina at production?

We recommend a staging environment that mirrors production. Testing sends a large number of requests and creates data with your test accounts, so production is only a good idea if you're comfortable with both.

Will you test anything I didn't list?

No. Testing stays on the URLs you submit, and those must be on a domain you have verified. Links to third-party services are left alone.

What happens to the test accounts I give you?

Passwords are encrypted as soon as you submit them and deleted when the test finishes. Use dedicated test accounts, never a real person's login.

Where is my data stored?

In the EU. Lumina, including the AI that runs your tests, runs in Paris, France. Your reports stay in your account; uploaded API specifications are deleted when the test finishes.

Do you train AI on my data?

No. Our AI runs in the EU, and your data and code are never used to train it.

What do I get at the end?

A report you can read in the browser or save as a PDF: a summary by severity, then every finding with its impact, reproduction steps and remediation.

See what's hiding in your app

Verify a domain and start your first test in a few minutes.

Start a testTalk to us