Closed 31 findings and passed audit with zero criticals
A payments company had eight weeks before an audit and a security questionnaire from an enterprise prospect stalled on their desk. We threat-modelled the platform, fixed what was exploitable, and moved the checks into their pipeline.
- Client
- Payments platform preparing for SOC 2
- Duration
- 8 weeks
- Team
- 2 engineers, 1 security architect
- Delivered
- 2024
Measured impact
What was actually wrong
The platform had grown quickly and security had been handled reactively. Authorisation was enforced in the frontend on several endpoints, production secrets were shared through a password manager note, and nobody had ever restored from a backup.
- Tenant isolation enforced in the interface, not the API
- Long-lived credentials with no rotation and shared access
- No dependency, secret, or container scanning in CI
- Backups configured but never restored or verified
What we built and why
Findings were ranked by what an attacker could actually do with them, and remediation started at the top of that list rather than at the top of a scanner report.
Authorisation rebuilt server-side
A single policy layer now evaluates every request against tenant, role, and resource. Two hundred and forty integration tests assert that cross-tenant access fails, and they run on every pull request.
Secrets moved into managed rotation
All credentials were rotated into a managed secret store with scoped access and automated rotation. The shared note was destroyed and access reviews were put on a quarterly cadence.
Security became a blocking pipeline stage
Static analysis, dependency and container scanning, and secret detection now gate merges. An SBOM is generated per release, which answered eleven questionnaire items on its own.
Recovery proven, not assumed
We ran a full restore drill against production-shaped data and documented the timings. Rollback is now rehearsed monthly and completes in under three minutes.
“They found the tenant isolation gap in the first three days. We had been live with that for over a year. The fix came with tests that make sure it never comes back.”
Let us look at your architecture.
Two ways to start, both of them short. Bring the problem, not a specification — the first useful thing we do is tell you what we would build and roughly what it costs.
Book an architecture call
Fifteen minutes, no deck. We map your problem to an approach and tell you what a realistic scope and budget look like.
- A specific technical recommendation
- A budget band you can plan against
- An honest answer if we are the wrong fit
Send a written brief
Prefer to write it down? Email us the shape of the problem and we will reply with a first take, usually under 12 hours.
- Goes straight to an engineer, not a sales inbox
- We reply with an approach, not a brochure
- Attach anything: repos, docs, screenshots