BookingSync: API Pentest for Data Protection

Client:

BookingSync — a French platform for short-term rental property management

Industry:

Software Development

Focus:

Protecting personal data of users interacting via web portal and API

Main challenge:

Assessing the security of API endpoints to prevent data leaks and unauthorized access

Market:

International (primarily Europe)

Services provided:

Gray-box API penetration testing

Key Takeaways

Identified several low-level vulnerabilities

Delivered a report with security enhancement recommendations

Conducted a gray-box pentest of API endpoints

Reduced the risk of data leaks and avoided reputational damage

100%

compliance with API security best practices

low-level vulnerabilities identified and mitigated

weeks total duration of the testing process

BookingSync: API Pentest for Data Protection

Mar 28, 2025

14 min

Is API expansion always safe for a platform? The international company BookingSync decided not to take any chances and initiated an audit of its API endpoints. The Datami team performed a gray-box pentest and uncovered low-level vulnerabilities. The resulting recommendations helped BookingSync boost its API protection and reduce the risk of data leaks.

BookingSync is a French technology company that provides a platform for managing short-term rental properties. Serving an international market—primarily across Europe—BookingSync enables thousands of hosts and guests to access its services daily through a user-friendly web portal and API integrations.

While the company does not operate in a regulated industry, it handles large volumes of user personal data, making robust system security a top priority.

Objectives and challenges

BookingSync's primary concerns were unauthorized access to its API and potential data leaks. To proactively mitigate reputational risks, the company initiated a scheduled security assessment.

Project objective was to identify potential vulnerabilities in API endpoints and assess their resilience against external threats.

1. Conduct a gray-box pentest of the current API endpoints.
2. Detect vulnerabilities that could lead to data compromise and evaluate the overall security posture.
3. Deliver a comprehensive report with actionable recommendations for improving API documentation and planning future security testing.

Penetration testing

Gray-box pentest of API endpoints

Vulnerability identification

Discovery and prioritization of security risks

Reporting & recommendations

Detailed report with practical advice for improving security

Datami Methodology: Security Testing for BookingSync

Our approach

To assess the security of BookingSync’s API endpoints, Datami employed a gray-box penetration testing approach. The team had partial access to technical documentation, enabling a deeper analysis of endpoint logic and common access scenarios.

We combined automated scans using Burp Suite API Scan with manual testing methods to ensure thorough coverage of both standard and unconventional attack vectors.

Gray-box

The assessment was performed with limited internal knowledge, simulating the actions of a potential attacker with basic access and insight. This approach provided a realistic view of actual risk exposure.

Key stages and solutions

The Datami team conducted a focused security assessment of BookingSync’s API, targeting vulnerabilities that could potentially lead to personal data exposure. A hybrid approach was used, combining automated scanning via Burp Suite API Scan with manual analysis.

The process included the following key stages:

Preparation

Review of technical documentation, test planning, and selection of relevant API endpoints.
Testing

Gray-box pentest using both automated and manual methods, with a focus on authentication mechanisms and resistance to unauthorized access.
Analysis & Reporting

Compilation of a detailed report outlining identified low-level vulnerabilities, along with practical recommendations to improve API security and documentation quality.

Fewer critical risks — more confidence

Results and recommendations

At the start of the project, BookingSync faced an undefined risk level: the platform had been continuously expanding its API endpoints without a full security audit, posing potential threats to the integrity of users’ personal data.

During the gray-box penetration testing, the Datami team identified several low-level vulnerabilities. While not critical, these weaknesses could potentially be exploited to gain unauthorized access.

Datami provided BookingSync with the following recommendations:

Regularly assess new API endpoints for compliance with security standards.
Improve the structure and clarity of API documentation.
Implement an internal process for continuous API testing prior to releases.

Following the implementation of the recommendations, the platform’s security posture improved, and the risk of API-related compromise was significantly reduced. The company avoided a potential data breach that could have led to reputational damage.

The project was completed in just 3 weeks — nearly twice as fast as the typical market timeframe of 4–6 weeks. No critical incidents were detected, and all identified vulnerabilities were promptly addressed.

Key project takeaways

Thanks to Datami's testing, BookingSync gained a current and detailed view of its API security status, mitigated low-level risks, and developed a clear action plan for future improvements.

The project helped strengthen the protection of users’ personal data and prevent potential breaches.

This case study confirms that even advanced tech companies with mature digital products require regular penetration testing to maintain a strong security posture.

Pentest and Protection of Platform from DDoS

Discovered 30 vulnerabilities in two web applications
Implemented DataGuard and Cloudflare for DDoS protection

Services:

Black-box web app pentesting, implementation of Dataguard

Jul 8, 2025

P2P Platform Case Study: GDPR Compliance Audit

Improved GDPR compliance and avoided potential losses
Identified 10 vulnerabilities, including 3 critical ones

Services:

Penetration testing, smart contract audit, code security review

Jun 27, 2025

Case Study: Consulting Company Security Test

Identified 19 vulnerabilities, including 1 critical, and 8 medium
Provided security compliance recommendations

Services:

Black-box pentest of web resources and infrastructure

Jun 6, 2025

Back to all cases

Datami articles

Datami Newsroom

Ingram Micro confirms ransomware attack

California-based company Ingram Micro, headquartered in Irvine, California, has reported the discovery of ransomware in its internal systems. The attackers caused a disruption in order processing.

Jul 31, 2025 3 min

Automation vs. Pentesters: Can AI Replace Humans?

Datami Newsroom

Automation vs. Pentesters: Can AI Replace Humans?

Every year, companies are increasingly integrating automated tools into their cybersecurity processes. Automation is just one auxiliary tool that comes with both advantages and disadvantages that must be kept in mind.

Jul 25, 2025 3 min

Aviation and Cyber Threats: TOP Hacker Attacks on Airports and Aircraft

Datami Newsroom

Aviation and Cyber Threats: TOP Hacker Attacks on Airports and Aircraft

The aviation industry is one of the most technologically advanced sectors, significantly influenced by digitalization. At the same time, this increases its vulnerability to cyber threats, which can have catastrophic consequences.

Jul 23, 2025 3 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.