Confidential FinTech Platform
Web Application & API Security Assessment
Sanitized case study — client details withheld for confidentiality.
The ask.
A fintech platform processing customer transactions needed both its customer-facing web app and the REST API behind it assessed — with particular attention to whether authorization decisions were being made server-side or trusted from the client.
Approach.
We mapped the full API surface (including undocumented internal endpoints found through JS bundle analysis and mobile app traffic), then tested every state-changing operation for broken object-level authorization (BOLA/IDOR), broken function-level authorization, and mass assignment. Financial platforms live and die on business logic, so transaction flows — transfers, limit changes, account linking — got manual, transaction-by-transaction review rather than pure fuzzing.
What we found.
A BOLA vulnerability allowing authenticated users to view another user’s full transaction history and linked account details by modifying an account ID parameter; and a mass-assignment flaw in the account update endpoint that allowed a standard user to elevate their own account’s transaction limits by including unexpected fields in the request body.
Included JWT validation weaknesses (accepting alg: none in a legacy fallback path), insufficient authorization checks on internal admin API routes reachable from the public internet, and predictable API keys issued during account creation.
Rate limiting gaps on sensitive operations, information disclosure through inconsistent error handling, missing security headers, and overly permissive CORS configuration on select endpoints.
Why it mattered.
In fintech, authorization bugs aren’t just data exposure risk — they’re direct financial fraud risk. The mass-assignment finding, if exploited at scale, would have let any user quietly raise their own transaction ceilings. This is the category of finding regulators and auditors specifically look for.
Outcome.
Findings were prioritized by exploitability and financial impact, with the two Critical issues fixed within 48 hours of disclosure. We provided a supplementary write-up mapping findings to OWASP API Security Top 10 categories to support the client’s compliance documentation.
Similar exposure in your environment?
This engagement began with a conversation about scope. Start yours the same way.