Tenant Isolation Checkup

Find multi-tenant API endpoints that leak one customer's data to another before launch

Problem

The classic serious bug in multi-tenant SaaS is a new reporting endpoint that forgets the tenant filter: functional tests pass, but customer A can read customer B's data. Founders know it's dangerous, yet nobody has time to pen-test every new endpoint or knows how many are leaking.

Solution

Connect a staging environment, then use two test tenants' credentials to automatically walk API endpoints and detect cross-tenant data leaks, IDOR, and missing tenant context. It outputs reproducible reports with drop-in fix rules and hooks into CI so every release is checked.

Users

B2B SaaS teams of 1–10 people, especially early startups adding endpoints fast and facing enterprise security questionnaires

MVP

Two-tenant setup and credential management; automatic endpoint crawling and cross-requests; cross-tenant leak and IDOR rules; reproducible report; one-click CI integration

Revenue

Monthly subscription tiered by endpoint count or scan volume, plus a premium tier for security-questionnaire workflows

Why now

AI coding agents have multiplied endpoint counts while security review hasn't sped up, and enterprise buyers ask increasingly specific tenant-isolation questions