Savannah Advisory was engaged by Afro Legacy, a payment system provider based in Uganda, to conduct a comprehensive penetration test to assess the security of their payment system, AfroPay. The primary objective of the penetration test was to identify potential vulnerabilities and weaknesses within Afro Pay. By Conducting the test, we aimed to evaluate the system’s adherence to the security requirements set forth in the National Payment Systems Act 2020. The purpose of this engagement was to identify security vulnerabilities and assess the overall security posture of the web API infrastructure.