Background
A B2B sales intelligence platform brought us on to build dashboard and infrastructure features ahead of a client rollout. Early testing on the platform's own login flow, done as part of getting familiar with the system, surfaced enough irregularities to justify a full manual security pass on the live API, run alongside the build work.

Scope
Testing was manual, run against the live production API. It covered the authentication flow, session handling, every endpoint reachable from the frontend bundle, CORS configuration, and any publicly served documentation or static assets.

What was found
Two live client accounts were confirmed through differing login error messages, one indicating no such account and the other indicating a wrong password. That distinction alone confirmed a valid account existed, a textbook username enumeration flaw. The login endpoint was then tested against automated password attempts. No rate limiting was in place. Fifty-plus attempts went through with no lockout and no change in behavior.

The larger issue sat one layer up. A static documentation file, served with zero authentication at a public path, contained the platform's complete internal architecture: every backend file path, every environment variable name including API keys and integration secrets, the full client roster, and an internal development roadmap. Anyone who found the URL had a complete map of the system before writing a single request.

That map made the rest trivial. Cold requests, sent with no token at all, returned full dashboard data for both client accounts: pipeline values, account names, KPIs, and every tracked sales signal. The account endpoint went further, returning a complete contact database for a live client, full names, emails, phone numbers, and revenue figures, alongside live visitor-tracking data for real companies actively browsing that client's website in production.

The most serious confirmation came from the write path. A snapshot-creation endpoint accepted unauthenticated POST requests and wrote directly to the production database. Sending one confirmed the vulnerability by actually creating a record with no login of any kind. A separate endpoint relayed requests straight through to a third-party AI API with no authentication layer in front of it, meaning anyone who found the path could consume the platform's own API budget at will.

CORS configuration compounded the exposure: the API reflected arbitrary origins back with credentials allowed, which would let a malicious site read authenticated responses from a victim's browser session.

How verification worked
Every finding was confirmed through direct testing rather than inference. The dashboard and account endpoints were called cold, with no Authorization header present, and the responses were checked for real data rather than error states. Rate limiting was tested by running a sustained automated attack against the login endpoint and confirming the absence of any lockout behavior across dozens of requests. The write vulnerability was confirmed the only way that matters: by sending the request and verifying that a record actually appeared in the client's production data, not just that the server returned success.

Outcome
The critical findings, the unauthenticated write access and the fully public documentation file exposing every secret in the system, were escalated directly and immediately rather than held for a final report. The full severity breakdown, from the public docs file down to informational stack-fingerprinting details, was documented and handed to the client for remediation.

Notes for teams shipping fast on modern backends
This wasn't an AI-generated app, but a conventionally built backend, which is worth noting: unauthenticated endpoints and exposed documentation aren't unique to AI code builders. They're what happens when auth gets treated as a later step instead of a default. A docs file left in a public static folder, an endpoint shipped before auth middleware was wired up, a CORS wildcard left over from local development, none of these require an AI-assisted stack to happen. They require nobody testing the API the way an attacker would before it goes live with real client data behind it.