How a Pre-Launch OWASP Audit Blocked 11 Exploitable Vulnerabilities Across a Node.js SaaS API
Written by Erik T., Backend Engineer at Codanum
The Context
A Europe-based SaaS startup already had paying pilot customers on a platform nobody had formally security-tested. The subscription B2B dashboard, built on Node.js and PostgreSQL, held sensitive business data for multiple client accounts, and public beta was weeks away. The founding team had built fast without a dedicated security function, and they knew it.
The Challenge
The application handled multi-tenant data isolation, JWT-based authentication, a role-based permission system, and Stripe-connected billing, all areas where implementation gaps carry serious consequences. The codebase had grown quickly across three developers with no formal security review at any point. The founders needed a clear severity map of every exploitable issue before inviting enterprise buyers into due diligence conversations.
11
Issues Found
6 Days
Delivery
The Solution
The audit covered the full OWASP Top 10 attack surface across the REST API, admin panel, and React frontend. Every authenticated endpoint was tested for IDOR by replaying requests across tenant boundaries. JWT implementation was inspected for weak signing, missing expiry enforcement, and algorithm confusion attacks. SQL query construction was reviewed across every data access layer for injection paths. Admin routes were mapped against the permission middleware to identify any bypass conditions. The Stripe webhook handler was tested for replay and spoofing vectors. Findings were documented with proof-of-concept reproduction steps and remediation code for each issue.
The Impact
The audit surfaced 11 vulnerabilities: 2 tenant boundary IDOR flaws allowing cross-account data reads, 3 broken access control gaps on admin endpoints, 2 JWT implementation errors including a missing expiry check on password-reset tokens, 1 raw SQL concatenation path, 2 sensitive field exposures in API responses, and 1 Stripe webhook replay vulnerability. A severity-ranked remediation report was delivered in 6 business days. All critical issues were patched before the public beta went live.
"The IDOR findings alone justified the entire engagement. Cross-tenant data leakage at beta would have been a business-ending event for us. Having a clear fix roadmap meant our developers could patch everything in a focused sprint before launch."
