← Apps feitas com IA
Security audit · B2B platform · 2026
A critical flaw nobody had seen
- customers already in production, with third-party data
- 2customers already in production, with third-party data
- audit phases: architecture, outside testing, inside testing and analysis
- 4audit phases: architecture, outside testing, inside testing and analysis
- critical privilege-escalation flaw identified and documented
- 1critical privilege-escalation flaw identified and documented
The context
A B2B platform built fast with vibe coding, with two customers in production and a third one closing. The founder wanted to grow, but didn't know what was exposed.
The problem
A first look from the outside already showed worrying security signs. The audit confirmed the worst: a regular user could grant themselves administrator permissions through the API — with access to the data of every customer on the platform.
What we did
- Four-phase audit: architecture and code review, outside testing (as an attacker without an account), inside testing (as an authenticated user) and final analysis.
- Report with an action plan: each finding with severity, controlled proof and the recommended fix, in order of priority.
The result
The critical flaw was identified and documented, with a prioritised remediation plan for the client's team.
Was your app built with AI too?
30 minutes to understand what's at risk — and whether you really need an audit.