Sanitized narratives from real engagements — what the client faced, how we approached it, what changed afterwards.
Client: Content-Driven Web Platform Operator — Headless CMS Architecture · Digital Media / Content Platform
The client runs a content platform on a headless CMS architecture, with a separate front-end application and admin backend. They wanted proof of exploitability, not just a vulnerability list — confirmation of what an attacker could actually extract or manipulate, and clear guidance on fixing it.
Chained several individually-minor GraphQL exposures into a single High-severity finding, then found the client's own code trusted their internet-exposed development environment as a data source — a bridge from a lower-security environment straight into production.
Client: Fintech / Payments Platform — API and Web Ecosystem · Fintech · Payments
The client runs a multi-subdomain API and application ecosystem — core API, real-time services, an app-building console, identity/auth, and a third-party-hosted transaction widget. They needed a realistic, production-environment assessment of how much damage an attacker with partial insider knowledge could do, without disrupting live users or real transactions.
Found a critical CORS misconfiguration that let arbitrary origins pull sensitive user data from the API — the client shipped a fix before the engagement even closed — then kept digging and surfaced a long-lived auth token and a residual trust-boundary gap the quick fix had missed.
Client: Healthcare Services Company — Patient-Facing Web Platform · Healthcare Services · Web Platform
The client operates patient-facing web platforms and wanted an external attacker's view of their real-world exposure — starting from nothing but public URLs, the same starting point any opportunistic attacker would have. Given the sensitivity of the data involved, the priority was finding anything that could lead to a full compromise, not just a checklist of missing headers.
Found a debug endpoint left enabled in production that disclosed a remote-code-execution capability outright — plus the credential leaks, injection points, and hardening gaps needed to build a realistic end-to-end attack path against a healthcare-adjacent platform.
Client: Mid-Market Consumer Goods Company — Public Web Platform · Consumer Goods · Public-Facing Web Platform
The client runs a public-facing web platform plus a wide footprint of adjacent internet-exposed subdomains and internal tools. They wanted an outside-in view of their real production security posture — how much an anonymous attacker with zero prior access or credentials could actually reach and compromise, not just a checklist of best-practice gaps.
Found an exposed deployment configuration file that alone handed over the client's full application source code and a database dump — with zero prior access or credentials — inside a broad external attack-surface assessment that also caught the chained flaws needed to turn it into account takeover.
Client: Ukrainian Physical Security & Video Surveillance Integrator · Physical Security · Video Surveillance
The client integrates and operates IP camera systems for its own customers' physical security. Camera hardware and firmware come from a single vendor across the fleet, and the client had no independent assurance the devices themselves — as opposed to the software layer they control — were sound. IoT camera botnets were an active, rising threat class, and a single systemic firmware flaw could compromise every deployed unit at once rather than one customer site.
Found a hardcoded, publicly-known administrator credential baked into the camera's firmware — identical across every unit of that model in the client's fleet — and delivered a phased remediation roadmap ahead of active botnet exploitation targeting the same device class.
Client: Multi-Tenant B2B SaaS Platform Operator — Microservices Architecture · B2B SaaS · Multi-Tenant Platform
The client operates a multi-tenant SaaS platform, delivered as a set of backend microservices behind an API gateway, where each tenant's data must stay strictly isolated from every other tenant's. A SOC 2 assessment was approaching, and the client needed independent, technical assurance that tenant isolation actually held under adversarial testing — not just architectural intent.
Found that multiple backend services derived tenant identity from a client-supplied request header instead of the authenticated session — letting any authenticated user read and write every other tenant's data — and delivered a severity-ranked fix path ahead of the platform's SOC 2 assessment.