CASE STUDIES
AI-built SaaS platform (international market, handling real user contracts and payment data)
The Cost of Advertising Security You Don't Have: Audit of an AI-Built SaaS Platform
A SaaS generation platform built with AI assistance marketed itself directly on enterprise-grade security and end-to-end data protection, while handling real user contracts, payment details, and digital signatures. A security audit found four high-severity issues, including a session token architecture that turns any future XSS bug into permanent account takeover.
Primary finding
Four high-severity findings, including a hardcoded backend key in the frontend bundle and a session/refresh token architecture that enables permanent account takeover following any XSS exposure
Developer tooling / SaaS platform (enterprise and regulated-industry positioning)
When Everything Passes Except the One Thing That Matters: Security Audit of a Developer Tooling Platform
A developer-tooling platform marketed at regulated industries passed nearly every standard security check: no exposed secrets, Grade A security headers, working rate limiting. A single manual behavioral test, logging out and checking whether access truly ended, uncovered a session invalidation flaw that let logged-out users remain fully authenticated indefinitely.
Primary finding
Session tokens remain fully valid after logout, confirmed via cross-context proof of concept, alongside full PII exposure on the session endpoint.
B2B SaaS (sales intelligence platform)
From Build Contract to Critical Disclosure: Security Audit of a B2B Sales Platform
A development contract to build dashboard and infrastructure features expanded into a full security audit after early testing on the platform's login flow surfaced deeper issues. The audit found 15 unauthenticated API endpoints, a public documentation file exposing the entire backend architecture, and confirmed unauthenticated write access to production data.
Primary finding
15 confirmed unauthenticated endpoints across dashboard access, account data, database writes, and an AI chat relay
Consumer marketplace / early stage (pre-launch)
From Vibe-Built to Secure: Full Security Audit of an AI-Generated Marketplace App
A founder building a peer-to-peer fashion marketplace on Base44 came in ahead of launch wanting to know whether the app was actually secure before putting real buyers, real sellers, and real payments on it. The audit produced 23 findings, including a checkout flow that let buyers purchase items at any price they chose and six database tables with no access controls whatsoever.
Primary finding
Unauthenticated Stripe checkout with client-supplied pricing, allowing any buyer to purchase any item at an arbitrary price, alongside missing RLS across six entity tables confirming full cross-account read and write access