Authenticated web application pentest

We log in with a user for each role and look for what a scanner cannot tell apart: broken business logic and permissions that fail to separate what they should.

What it includes

One user per role, to detect horizontal and vertical access between accounts.
Business logic: payment flows, coupons, state changes and limits that fall by changing one value.
Injection, unsafe deserialisation, SSRF and file upload, each one verified by hand.
Review of the API behind it, not only of what the interface does.