# Security Testing for SaaS Apps

AgentProof tests whether one customer of your SaaS app can reach another's workspace, data or roles, and fixes the code if so.

A SaaS app keeps every customer's data in one system. AgentProof checks that each customer can reach only their own workspace, and fixes your code when one can reach another's.

## The Attack Agent tries to read a customer's data from another account.

- **WORKSPACES** Can a user at one company open another company's projects by changing the ID in a request?
- **ROLES** Can a member give themselves the admin role, or open the admin settings?
- **INVITES** Can an old invite link, or one sent to someone else, still add a person to a workspace?
- **BILLING** Can a customer turn on paid features by changing the plan name in a request?

These are the problems that let one customer see another customer's data. **Any app with more than one customer can have them.**

## An example: a member of Company A could read Company B's project list.

Example finding: A member of one company can read another company's projects

```
REQUEST
GET /api/workspaces/88/projects
Signed in as a member of Company A

RESPONSE
200 OK
Workspace 88 belongs to Company B

FIX
+ await requireMember(user.id, params.workspaceId);
  const projects = await listProjects(params.workspaceId);

RETEST
GET /api/workspaces/88/projects
403 Forbidden. Fixed.
```

The fix checks that the user belongs to the workspace **before any of its data is read**.

## New features are tested soon after they ship. Every result is kept.

- **Tests each release:** With weekly or daily checks, a new endpoint is tested within a week or a day of going live.
- **Keeps the record:** Each report shows what was tested, what was found and how it was fixed. Reports stay in your account for as long as you have it.

## Answers to questions SaaS teams ask before they connect their app.

- **Does this replace a SOC 2 audit?** No. AgentProof tests and fixes your app. It does not certify your company for SOC 2 or any other standard. Its reports show what was tested and how each problem was fixed.
- **How do fixes reach our code?** You choose: a pull request your team reviews, an automatic merge after your checks pass, or a change applied straight to your running app.
- **Can the whole team see reports?** Yes. Invite as many teammates as you want at no extra cost. Reports go to your dashboard, email and Slack.

## One plan covers one SaaS app with both agents.

Monthly checks cost $199 a month. **Weekly and daily checks cost $399 and $999 a month.**

- [See plans](/pricing/)
- [See how fixes work](/defense/)

## AgentProof also tests these kinds of apps.

- [AI products](/solutions/ai/): Checks chats, shared links, model keys, usage limits and the tools your assistant can use.
- [Fintech](/solutions/fintech/): Checks accounts, transfers, amounts and approvals in apps that move money.
- [Health tech](/solutions/health-tech/): Checks that patients and staff see only the records they are allowed to see.
- [Marketplaces and stores](/solutions/marketplaces/): Checks prices, orders, payouts and the line between buyers and sellers.
- [Apps built with AI tools](/solutions/ai-built-apps/): Checks database rules, exposed keys and unprotected routes in apps written with AI coding tools.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.