Security
Security and code audit of an inherited platform
When a client took over a platform built by a previous team, we audited its code and security to find exactly what was wrong before anyone built anything new on top of it.
A full security and code audit of an inherited marketplace platform across five inherited codebases, surfacing the critical issues hiding in someone else's code before anything new was built on top of it.
- Manual code review
- Semgrep static analysis
- Threat modeling
- Secrets and auth review
- Remediation planning
A marketplace came to its new owners running on a platform built by a previous team, with no clean handover and real questions about how safely it handled customer data. Building new features on an unknown, possibly unsafe foundation would only deepen the risk. The responsible first move was to find out exactly what was there. We ran a full security and code audit across the whole platform so the owners knew precisely what they had inherited and what to fix first.
The platform was already live with real users, so the audit had to assess it without disrupting the running business.
The codebase was inherited with no documentation, spanning five separate codebases: a backend, a web frontend, an admin panel, a mobile app, and an archived site.
The assessment had to combine automated scanning with human judgment, because the most dangerous issues hide in how the pieces fit together.
The output had to be honest and prioritized, so the owners could fix the most dangerous problems first on a tight timeline.
Ran an independent audit of all five inherited codebases, the backend, web frontend, admin panel, mobile app, and an archived site, across eleven analysis passes that combined manual code review with automated scanning.
Surfaced the critical exposures, including production credentials committed in source, SQL injection in search and listing endpoints, payment webhooks accepted without a signature check, dozens of routes missing authentication, and unsalted password hashing.
Catalogued every finding into a clear priority order, from the critical exposures down to lower-risk hardening.
Delivered a prioritized remediation plan and resourcing recommendation, so the owners could close the critical issues first and harden the rest in sequence. Remediation is underway.
Outcomes
All five inherited codebases were reviewed across eleven analysis passes, because risk lives across the whole platform, not in one place.
Credentials committed in source, SQL injection in search and listing, payment webhooks with no signature check, and dozens of routes missing authentication, all found before any new work was built on top.
Every finding was sorted into a clear priority order, so remediation starts with what is genuinely dangerous and works down from there.