🚨 The Vulnerability That Could Have Ended Everything

SecureNest's platform held KYC documents — Aadhaar, PAN, rental agreements — for over 22,000 users. A routine security review by their investor's due diligence team flagged a single URL: GET /api/documents/1847. By changing 1847 to 1848, any logged-in user could download someone else's Aadhaar card. This was a textbook IDOR vulnerability — and it affected every single document in their database.

The deeper audit revealed this was just the tip of the iceberg: passwords stored as unsalted MD5 hashes, no rate limiting on login endpoints (trivial brute-force), and SQL injection vulnerabilities on 6 search filters. The startup was one public disclosure away from regulatory penalties under India's DPDP Act 2023 and complete investor pullout.

🔍 Audit Scope: 67 Endpoints, Full Stack

Vulnerability Category Count Found Severity
IDOR (Broken Object Level Auth) 1 systemic Critical
Weak Password Hashing (MD5) 1 (all users) Critical
SQL Injection Points 6 endpoints Critical
No Rate Limiting All 67 endpoints High
Missing Input Sanitization 14 endpoints High
Sensitive Data in HTTP Logs 3 endpoints Medium

🔐 The Hardening Sprint: 3 Weeks

Week 1 — Critical Fixes

  • IDOR Elimination: All sequential integer IDs replaced with UUID v4. Authorization middleware added to every document endpoint — checks ownership before serving
  • Password Migration: bcrypt (cost factor 12) implemented. All existing MD5 hashes invalidated; users prompted for forced reset on next login
  • SQL Injection: Parameterized queries enforced across all 67 endpoints using Knex.js query builder

Week 2 — Perimeter Hardening

  • Rate Limiting: Redis-backed rate limiter (express-rate-limit) — 5 attempts/15min on auth endpoints, 100 req/min on data endpoints
  • Input Validation: Joi schema validation middleware on all POST/PUT endpoints
  • Cloudflare WAF: Deployed with managed rulesets for OWASP Core Rule Set, bot management, and DDoS protection
  • Helmet.js: HTTP security headers — CSP, HSTS, X-Frame-Options enforced

Week 3 — CI/CD Security Gates

  • Snyk: Automated dependency vulnerability scanning on every PR
  • Dependabot: Auto-PRs for security patch updates
  • OWASP ZAP: Integrated into GitHub Actions — automated scan on every merge to main
  • AES-256 Encryption: Aadhaar and PAN numbers encrypted at rest in PostgreSQL

📈 Post-Hardening Status

Security Metric Before Audit After Hardening
Critical Vulnerabilities 22 0
OWASP Compliance Score 31/100 94/100
Data Breach Incidents Imminent risk Zero (6 months)
ISO 27001 Readiness Not assessed Certified (45 days)