A code-level review that caught exposures an external scan walks straight past.
An FCA-regulated insurance broker had a customer-facing quote and application tool with serious problems hidden in its code. A full-access credential for the customer database had been left in a forgotten, publicly downloadable copy of the app, regulated bank details were being handled in visitors’ browsers and sent to third parties in plain text, the app’s own endpoints accepted anonymous changes to customer records, and sensitive health data was handled insecurely with a privacy notice that did not exist.
We reviewed the codebase and confirmed the findings against the live site, then delivered a single prioritised roadmap ordered by real-world risk. It began with a same-day list to rotate the exposed credentials, remove the forgotten file and stop collecting bank details in the browser, followed by phased work to lock down the endpoints, move sensitive data to a secure server-side flow, and close the compliance gaps. We were equally clear about what the app already got right, so effort went where it mattered.
The client received a clear, actionable plan that took the app from openly exposed to genuinely defensible, led by the handful of live exposures that mattered most. The worst of them, a full customer-database credential, was the kind of finding an external scan walks straight past and only a code-level review catches.
Whether it is security, hosting, compliance or a site that is misbehaving, we will take a look and tell you straight.
Get in touch