Confidential SaaS Company
Full Web Application Penetration Test
Sanitized case study — client details withheld for confidentiality.
The ask.
A multi-tenant B2B SaaS platform serving enterprise customers needed an authenticated, human-led assessment before a security-conscious prospect would sign a six-figure contract. The client’s core worry wasn’t XSS or SQLi — it was whether Tenant A could ever touch Tenant B’s data.
Approach.
We provisioned test accounts across every role tier (admin, standard user, read-only, billing-only) in two separate tenant workspaces, then systematically cross-tested every authenticated endpoint by swapping tenant/org identifiers, session tokens, and object references between the two. This wasn’t automated scanning — tenant isolation bugs live in business logic, not signatures, so every workflow (invite flows, report generation, webhook config, data export) was walked manually.
What we found.
A horizontal privilege escalation path where a low-privilege user in Tenant A could access another tenant’s exported reports by predicting a sequential resource ID in an authenticated API call — no additional authorization check was performed server-side.
Session tokens that remained valid after password reset; an admin-only settings endpoint reachable by any authenticated role via direct object reference; a password reset flow vulnerable to token reuse within a short race-condition window.
Missing rate limiting on login, verbose error messages leaking stack traces, inconsistent session timeout enforcement across the app vs. the API.
Why it mattered.
The Critical finding was the exact failure mode enterprise buyers fear most in SaaS — cross-tenant data exposure — and it was reachable with nothing more than a valid low-tier account and a modified request. This is the kind of finding that ends procurement conversations if discovered by the customer instead of by us.
Outcome.
All findings were retested and closed within the client’s remediation window. The tenant isolation issue was fixed with server-side authorization checks scoped to session-bound tenant context rather than trusting client-supplied identifiers — and the client used our final report directly in their next enterprise security questionnaire.
Similar exposure in your environment?
This engagement began with a conversation about scope. Start yours the same way.