A security audit before card acquiring went live
The bank asked for a test report. We found access to other customers’ orders via a direct link, and a promo code that applied twice.
- Client
- E-commerce, 40 staff
- Industry
- Retail
- Year
- 2026
- Duration
- 7 working days
The shop was moving to direct card acquiring, and the bank required an independent test report. There was no in-house security team.
What we did
and why we did it that way.
Reconnaissance
We found a forgotten test environment holding a copy of the production database, open to the internet.
Logic flaws
The scanner produced 2 findings, manual testing another 12. The most expensive one was access to someone else’s order via the number in the URL.
The economics of a vulnerability
A promo code applied twice under concurrent requests. We worked out what that would have cost over a quarter.
Retest
After the team’s fixes we re-ran the scenarios at no charge: two of the findings had not been fully closed.
What changed
and what we measured it with.
How it went
day by day and week by week.
- Day 1
Scope and NDA
We fixed the perimeter and ruled out destructive testing.
- Days 2–3
Reconnaissance
Subdomains, environments, entry points.
- Days 4–6
Exploitation
Critical findings were sent over immediately, without waiting for the report.
- Day 7
Report
Priorities, proof of concept, a summary for management.
How it looks
in schematics.
These are screen schematics. We do not publish client interfaces without permission
A similar problem
on your side?
Describe it in the brief. In working hours we come back with an estimate of time and cost within two hours.