Fast doesn't mean tested
A Europe-based SaaS startup came to us with paying pilot customers already on their platform, and public beta weeks away. Three developers had built fast, which is exactly what an early-stage team should do, but nobody had run a formal security review at any point. Their subscription dashboard held sensitive multi-tenant business data on Node.js and PostgreSQL. The founders knew the gap existed. They wanted a severity-ranked map of it before inviting enterprise buyers into due diligence conversations, not after.
Where we actually looked
We ran the full OWASP Top 10 attack surface across the REST API, the admin panel, and the React frontend. That meant replaying authenticated requests across tenant boundaries to test for IDOR, inspecting the JWT implementation for weak signing and missing expiry enforcement, reviewing SQL query construction across every data access layer for injection paths, mapping every admin route against the permission middleware for bypass conditions, and testing the Stripe webhook handler for replay and spoofing vectors.
Every finding got documented with a proof-of-concept reproduction, not just a description, because a severity rating without a repro is something a founder has to take on faith.
Eleven findings, and why the IDOR flaws outranked everything
The audit surfaced 11 vulnerabilities: 2 tenant-boundary IDOR flaws that allowed cross-account data reads, 3 broken access control gaps on admin endpoints, 2 JWT implementation errors (including a missing expiry check on password-reset tokens), 1 raw SQL concatenation path, 2 sensitive field exposures in API responses, and 1 Stripe webhook replay vulnerability.
The IDOR flaws mattered most, and it's worth explaining why they outrank something like a SQL injection path on a severity list even though injection sounds scarier. This was a multi-tenant B2B platform. Cross-tenant data leakage isn't a bug you patch and move past, it's the kind of finding that ends a sales conversation the moment a prospective enterprise customer's security team hears about it during due diligence. A platform that leaks Tenant A's data to Tenant B has failed the one guarantee multi-tenant software exists to make.
Six days, and what happens after the report
The full severity-ranked remediation report, with reproduction steps and fix guidance for each finding, was delivered in six business days. Every critical issue was patched by the team before public beta went live.
The pattern we see across early-stage audits like this one: the vulnerabilities are rarely exotic. They're the predictable result of moving fast across multiple developers with no shared security review checkpoint, authorization checks that work for the happy path and quietly don't for the edge case, JWTs that get implemented once and never revisited. None of the 11 findings here required an unusual attacker. They required someone to actually go look, systematically, before the platform had real customer data at stake for real.
Want the full client story behind this?
Read the Case Study →
