A security audit before card acquiring went live
The bank asked for a test report. We found access to other customers’ orders via a direct link, and a promo code that applied twice.
- Client
- E-commerce, 40 staff
- Industry
- Retail
- Year
- 2026
- Duration
- 7 working days
The shop was moving to direct card acquiring, and the bank required an independent test report. There was no in-house security team.
What we did
and why we did it that way.
Reconnaissance
We found a forgotten test environment holding a copy of the production database, open to the internet.
Logic flaws
The scanner produced 2 findings, manual testing another 12. The most expensive one was access to someone else’s order via the number in the URL.
The economics of a vulnerability
A promo code applied twice under concurrent requests. We worked out what that would have cost over a quarter.
Retest
After the team’s fixes we re-ran the scenarios at no charge—two of the findings had not been fully closed.
What changed
and what we measured it with.
How it went
day by day and week by week.
- Day 1
Scope and NDA
We fixed the perimeter and ruled out destructive testing.
- Days 2–3
Reconnaissance
Subdomains, environments, entry points.
- Days 4–6
Exploitation
Critical findings were sent over immediately, without waiting for the report.
- Day 7
Report
Priorities, proof of concept, a summary for management.
How it looks
in schematics.
These are screen schematics. We do not publish client interfaces without permission
A similar problem
on your side?
Describe it in the brief. In working hours we come back with an estimate of time and cost within two hours.