Case study · Application security audit
An auction platform, tested before launch. Every serious issue fixed and retested before go-live.
A Harare auction business asked for an independent check before opening its platform to the public. We tested it by hand, reported as we went, and retested every fix before the first real bid.
The situation
Live bidding, real customer data, no security review yet
The platform handled registration, live bidding and payment coordination, so it stored personal information about every buyer and seller.
It had been built by a capable developer without a security background. The owners wanted to know what an attacker would find before customers arrived.
We signed a written authorisation agreement and started the same day.
The outcome
Launched with every serious issue closed
Every issue came with what it meant for the business and exactly what to change, ranked so the developer knew what to fix first. Anything serious was flagged by phone the day it was found, before the written report was finished, so the fix could start immediately.
Before go-live we retested each fix and confirmed every serious issue was closed. What was found, and where, stays with the client.
Timeline
One week from authorisation to a clean retest
- Day 1 Written authorisation signed, manual testing begins
- Day 1 Anything serious reported to the client straight away, by phone
- Day 2 Written report delivered, fixes ranked by priority
- Days 3 to 5 Fixes made by the client's developer
- Day 7 Retest: every serious issue confirmed closed before launch
Your platform
Find out what an attacker would find, before launch
Manual penetration testing from $1,200, with a written report and a retest after you fix the findings.