Loading...
All Projects
Security & AuditsIN DEVELOPMENT
REDHEN
A rescue mission: auditing a marketplace the client could no longer safely run.
A rescue mission, not a build. I ran the technical due-diligence audit and takeover of a farm-to-consumer marketplace (NestJS backend, two Flutter apps) the client could not safely operate: roughly 74 findings with file-and-line receipts, 11 of them critical, delivered as 7 audit documents with credential-rotation runbooks and a phased, priced remediation roadmap.
- Client
- Confidential (farm-to-consumer marketplace)
- Role
- Technical Auditor
- Timeline
- 2026 — Present
RESCUE AUDIT
- Findings with receipts
- ~74
- Critical vulnerabilities
- 11
- Audit documents
- 7
- Bug corrupting inventory
- 1 word
The Challenge
The client acquired a farm-to-consumer marketplace, a NestJS backend and two Flutter apps, and quickly realized they could not safely operate what they owned. Refunds misbehaved, nobody knew which credentials were live, and the previous vendor was gone. They needed to know, in writing, how bad it was before touching anything: a due-diligence audit with receipts, not a skim-read.
The Solution
I audited the system top to bottom and wrote down everything: roughly 74 findings, each with file-and-line evidence, 11 of them critical. The headlines: a one-word bug (increaseProductsStock internally calls decrement) that actively corrupts inventory on every refund or cancel; 4-digit password-reset tokens with unlimited guesses; Stripe transfers inside serializable transactions with no idempotency keys, a double-pay risk; store-signing keys for both apps committed to the repo with the keystore password sitting next to them in plaintext; production apps streaming typed passwords into Crashlytics. The deliverable was 7 audit documents: findings, credential-rotation runbooks, and a phased, priced remediation roadmap. The audit also records what the codebase gets right, correct webhook verification, no IDORs, integer-cents money, because an audit that only lists fires is not a map.
The Outcome
The client now knows exactly what they own and what it costs to fix, in what order. Credential rotation followed the runbooks, and remediation is starting from the priced roadmap. The inventory-corruption fix is a one-word change with a test around it, which is the best kind of critical finding: cheap to close, expensive to have missed.
Highlights
- One-word bug actively corrupting inventory on every refund and cancel: increaseProductsStock calls decrement
- 4-digit password-reset tokens with unlimited guesses, trivially brute-forced
- Stripe transfers inside serializable transactions with no idempotency keys: a double-pay risk
- Store-signing keys for both apps committed to the repo, with the keystore password sitting next to them in plaintext
- Production apps streaming typed passwords into Crashlytics logs
- Credit where due: correct webhook verification, no IDORs found, and integer-cents money handling
Technology
NestJSFlutterSecurity AuditStripe
Have a project like this in mind?
START YOUR PROJECT