How to test security in a multi-tenant SaaS application

A multi-tenant SaaS application serves multiple customers using shared components. Its security depends on ensuring that one customer cannot access another customer's data or actions, including through paths that are easy to overlook, such as exports and background jobs.

Map the tenant boundary

List the resources that belong to a tenant, the roles that can access them and how the application determines tenant context. Include browser requests, APIs, scheduled tasks, service accounts, file storage and integrations. Identify any intentionally cross-tenant administrative access separately and check its permissions and audit trail.

Use two test tenants with distinct synthetic records. Confirm that an authorised user can access their own record, then attempt the equivalent action against the other tenant's record. Test read and write operations, list filtering, search and object identifiers where applicable. A hidden button is not an authorisation control.

Follow data beyond the first request

Check downloads, generated reports, cache keys and storage paths. If a request queues work, verify that the job carries trusted tenant context and applies appropriate authorisation when it runs. Consider what happens if membership or permissions change before execution. The expected behaviour must be defined for your application; a generic script cannot supply those rules.

Check both denial and side effects. A request may return an error after creating a record or starting a job. Keep tests in an agreed environment and avoid real customer data. OWASP's multi-tenant security guidance covers isolation across storage, caching and asynchronous work.

Make isolation checks repeatable

Turn the most important scenarios into regression tests and run them when relevant code or permissions change. Review coverage as new features and integrations appear. Passing tests demonstrate the tested scenarios, not every possible access path.

PolderLabs can help map tenant boundaries and build tests for your existing SaaS application. Learn about tailored security.