![BookingSync Case Study: API Pentest for Personal Data Protection]({"desctop":"assets\/images\/cache\/assets\/images\/cases\/case-study-8-en-998x499.png","desctop2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-8-en-1996x998.png","tablet":"assets\/images\/cache\/assets\/images\/cases\/case-study-8-en-1150x575.png","tablet2x":"assets\/images\/cases\/case-study-8-en.png","mobile":"assets\/images\/cache\/assets\/images\/cases\/case-study-8-en-740x370.png","mobile2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-8-en-1478x739.png"})
BookingSync is a French technology company that provides a platform for managing short-term rental properties. Serving an international market—primarily across Europe—BookingSync enables thousands of hosts and guests to access its services daily through a user-friendly web portal and API integrations.
While the company does not operate in a regulated industry, it handles large volumes of user personal data, making robust system security a top priority.
BookingSync's primary concerns were unauthorized access to its API and potential data leaks. To proactively mitigate reputational risks, the company initiated a scheduled security assessment.
Project objective was to identify potential vulnerabilities in API endpoints and assess their resilience against external threats.
To assess the security of BookingSync’s API endpoints, Datami employed a gray-box penetration testing approach. The team had partial access to technical documentation, enabling a deeper analysis of endpoint logic and common access scenarios.
We combined automated scans using Burp Suite API Scan with manual testing methods to ensure thorough coverage of both standard and unconventional attack vectors.
The Datami team conducted a focused security assessment of BookingSync’s API, targeting vulnerabilities that could potentially lead to personal data exposure. A hybrid approach was used, combining automated scanning via Burp Suite API Scan with manual analysis.
The process included the following key stages:
Every
At the start of the project, BookingSync faced an undefined risk level: the platform had been continuously expanding its API endpoints without a full security audit, posing potential threats to the integrity of users’ personal data.
During the gray-box penetration testing, the Datami team identified several low-level vulnerabilities. While not critical, these weaknesses could potentially be exploited to gain unauthorized access.
Datami provided BookingSync with the following recommendations:
Following the implementation of the recommendations, the platform’s security posture improved, and the risk of API-related compromise was significantly reduced. The company avoided a potential data breach that could have led to reputational damage.
The project was completed in just 3 weeks — nearly twice as fast as the typical market timeframe of 4–6 weeks. No critical incidents were detected, and all identified vulnerabilities were promptly addressed.
Thanks to Datami's testing, BookingSync gained a current and detailed view of its API security status, mitigated low-level risks, and developed a clear action plan for future improvements.
The project helped strengthen the protection of users’ personal data and prevent potential breaches.
This case study confirms that even advanced tech companies with mature digital products require regular penetration testing to maintain a strong security posture.
![Case Study Grindset Software: Payment System Pentest for PCI DSS Compliance]({"desctop":"assets\/images\/cache\/assets\/images\/cases\/10-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/cases\/10-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/cases\/10-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/cases\/10-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/cases\/10-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/cases\/10-en-1118x559.png"})
![Case Study: DAVITOO UKRAINE – LMS Security Testing Before HIPAA Certification]({"desctop":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-9-en-1118x559.png"})
![Case Study: Consulting Company – Security Testing of Web Resources and Infrastructure]({"desctop":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/cases\/case-study-7-en-1118x559.png"})
![Internal Network Penetration Testing: Identify Vulnerabilities Before Attackers Do]({"desctop":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/13-1-en-1118x559.png"})
Learn what an Internal Network Penetration Test is and how to prepare for it. Discover the meaning, stages, and challenges of conducting an Internal Network Pen Testing.
![Network Penetration Testing: What Is It?]({"desctop":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/12-network-pentest-1-en-1118x559.png"})
What is network penetration testing? Learn more about the approaches and types of network pentests, the key stages, and the outcomes of a network penetration test.
![Cybersecurity in healthcare: why hospitals have become a favorite target for hackers]({"desctop":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-554x277.png","desctop2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-1106x553.png","tablet":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-380x190.png","tablet2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-758x379.png","mobile":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-560x280.png","mobile2x":"assets\/images\/cache\/assets\/images\/blog-golovnij-bannera-1\/3-en-1118x559.png"})
Cybersecurity in healthcare is at risk: hospitals face more cyberattacks than banks. Learn how to protect medical data with expert tips from Datami.
