Cases
We tested ourselves first
We only publish client names with permission. For now — our own product: a tax and finance SaaS platform, web and mobile app.
Our own product
Tax and finance SaaS platform
Web platform + Android + iOS app
- Vulnerabilities found
- 15
- Closed
- 15
Website expertise
6 findings
- A "success" page was shown before the payment was confirmed
- Host header injection (X-Forwarded-Host was trusted)
- Information disclosure: the full route list was sent to the browser
- Excessive data in responses
- Actions performed without state checks (business logic)
- FTP and panel ports exposed to the internet
Mobile app expertise
9 findings: Android 7, iOS 2
- Root and jailbreak detection not implemented · Android · iOSHigh
- Sensitive data stored unencrypted · AndroidHigh
- No app integrity verification · AndroidHigh
- Insecure certificate validation · AndroidHigh
- No protection against dynamic analysis tools (Android and iOS) · Android · iOSHigh
- No emulator detection · AndroidMedium
- Insecure (http) links · AndroidLow
What we did
- RASP: root, jailbreak, emulators, hooks, debuggers and modified builds are detected — the app blocks itself in an unsafe environment.
- Certificate pinning: trust only specific root certificates (on both the Dart and Android side).
- Sensitive data moved to Keystore/Keychain, backups disabled, cleartext traffic turned off.
- R8 and Dart obfuscation; server addresses are no longer stored as plain strings.
- On the web: payment status only after provider confirmation, proxy headers restricted, routes hidden, ports closed.
Result
All 15 findings were closed, re-checked and resubmitted to the expertise.
The next case — yours
If you let us be the first to show your project, it will appear here.
Show us before you submit to the expertise
Leave a request: we scan your product and show exactly where the risks are and what it takes to close them.
Request a scan