field notes
Anonymized examples of critical findings and fixes.
what we find
01
On a multi-tenant AI platform, one organization's users could reach another organization's private data. We confirmed it under controlled conditions, closed it with a single authorization gate applied uniformly across every affected route, and pinned it with an integration test so it cannot silently return. The platform was still on test data, so this was caught before anyone's records were in it rather than after.
02
An outside advisor produced a fix list for a client's email authentication. Checking each claim against live DNS showed the proposed change would have authorized an entire shared-hosting address range to send as the client's domain. Confident and wrong is the expensive failure mode.
03
Inbound submissions were routed to a mailbox that had been deleted, then silently discarded by the email provider's suppression list. It surfaced by reading delivery logs instead of trusting that it was configured, and the messages already lost that way were recovered and delivered by hand.
what we leave behind
04
The platform had no automated tests at all. We built 355 of them, 351 unit and 4 integration, running on every proposed change through a pipeline that lints, typechecks, makes a production build, and executes the full suite against a throwaway database provisioned per run. The cross-tenant fix is enforced at the database layer, where it actually lives.
05
Seventy-eight findings triaged and prioritized, with the critical and high-severity work designed, built, and merged: about 36 changes. Identifier validation at every route boundary, per-IP rate limiting, security headers and a request-size cap, a request-smuggling vector rejected, and error responses that stop leaking internals to clients.
06
Production deploys rebuilt the application with no process restart and no health check. We delivered a rollback runbook and a deploy-hardening plan built on restart-and-health-check gating, so that a deploy either comes up healthy or bails loudly.
07
Months after we finished, the client was opening issues against their own new feature code for not meeting the identifier-validation and rate-limiting patterns the audit established, and holding new routes to them. The bar became theirs to enforce. That is the outcome we are actually selling.
how we know
Controlled probes against running systems with test accounts. SMTP-level mailbox checks. Network-level tracing of analytics and cross-domain measurement. Authoritative DNS queries. Used routinely to confirm that systems other people had declared finished were actually working. Several were not.
On labels: this is security audit, secure-code review, vulnerability discovery and remediation, threat modeling, and test and CI engineering. It is not red teaming or penetration testing. Where we verified a flaw against a running system, we did it with a controlled test account under the engagement. We will not call it something larger to make it sound better.
Want this done to your systems before someone else finds it?
Readiness audits start at $20,000.