A SaaS company's codebase and endpoints reviewed: secrets in git history, an IDOR in the API and a public storage bucket, fixed and retested
A software-as-a-service company of about 60 people with a multi-tenant web application and a public API.
- Scale
- ~4 repositories, ~120 API endpoints, 1 cloud storage bucket per environment
- Engagement
- 3 weeks of testing and fixes, with a retest in week 5
The challenge
A large prospect's security questionnaire asked for an independent review of the code and the internet-facing endpoints. The team had never searched its repositories for old secrets, had not tested whether one customer could read another customer's records, and was not sure which storage buckets were public.
A software-as-a-service company needed an independent review of its code and internet-facing endpoints, because a large prospect's security questionnaire asked for one. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. It was done only under a signed authorization that named the repositories, environments, test accounts and hours.
The first finding came from the repositories' history, not their current code. A secrets scanner run across every commit found a cloud access key and a payment-provider key that developers had committed years earlier and later deleted. Deleting a file does not remove it from git history, so both keys were still readable by anyone with a clone. The fix that protects the account is revocation and rotation, which was done the same day; rewriting history is optional, and the team decided that.
The second finding was an insecure direct object reference (IDOR), listed in the OWASP API Security Top 10 as broken object level authorization. With two test tenants, changing the invoice identifier in a request returned the other tenant's invoice, because the API checked that the caller was signed in but not that the object belonged to the caller. Tests like this need the application owner's consent, which is why the scope was written first. The fix was a single tenant check in the shared authorization layer, with automated tests that try cross-tenant access on every endpoint.
The third finding was a storage bucket for exported files, in Amazon S3 or Google Cloud Storage terms, that was readable by anyone on the internet. Public access was blocked at the account or project level, so one bucket's setting could no longer expose data, and downloads moved to short-lived signed URLs. Endpoint checks added smaller items: missing rate limits on a login route, verbose error messages and weak security headers.
Every finding was delivered with reproduction steps, a severity and a fix, then retested after the team's changes, with the retest evidence added to the report. The company now runs a secrets scan and cross-tenant tests in its build pipeline. This is the same service our team offers as a security review of code and endpoints, and it is a technical review, not a certification or a legal opinion.
What our team delivered
- Written authorization and rules of engagement signed first, naming the repositories, the staging and production endpoints, the test accounts and the hours; scanning started only after that
- Secrets scanning of the full git history, not only the current branch, which found a cloud access key and a payment-provider key in commits years old; both were revoked and rotated, and history rewriting was left to the team's decision because revocation is what protects the account
- Authenticated testing of the API with two test tenants: changing object identifiers in requests showed an insecure direct object reference (IDOR) on an invoice endpoint, because the server checked that the caller was signed in but not that the invoice belonged to the caller's tenant
- Review of the storage configuration, which found one bucket for user-uploaded exports readable by anyone; public access was blocked at the account level, and access moved to short-lived signed URLs
- Static analysis and dependency review of the codebase, endpoint checks for security headers, rate limits and verbose error messages, and a ranked report with reproduction steps for engineers and a summary for leadership
- Fixes as a server-side tenant check in one shared authorization layer, a pre-commit and pipeline secrets scan, and a retest that confirmed each finding closed, with the retest evidence attached to the report
Result
Every finding was fixed and retested within five weeks. The company answered the prospect's questionnaire with evidence, and a repeat of the same checks now runs in its build pipeline instead of once a year.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
AI agent bot, standard
One bot for a task that crosses two systems or handles varied documents, with exception handling and a review queue for your team.
About 3 to 4 weeks
$5,900 per bot
Show 3 more
Cyber automation starter
Automate one repetitive security task, such as user offboarding, alert triage or vulnerability ticketing, with a tested workflow and a runbook.
Live within 3 weeks of kickoff
$4,200 per automated workflow
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Attack it before attackers do
Our red team probes your systems the way a real attacker would, and every weakness it finds becomes a fix your defenders put in place and we retest.
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
Critical patches in days, not months
Distribution of days from vendor patch release to deployment for critical-severity CVEs, before and after a managed patching service. The dashed line marks two weeks: under CISA BOD 22-01, US federal agencies must remediate Known Exploited Vulnerabilities within two weeks for CVEs assigned in 2021 or later (six months for older ones). Private organisations are not bound by it, but it is a sensible benchmark. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.