Web, API, and cloud, reviewed as one system
A dual-track engagement for a DeFi private credit platform: a web and API pentest alongside a full AWS cloud audit, both pre-launch.
The scope, in short
- ENGAGEMENT TYPE
- Dual track: web application and API penetration test, plus AWS cloud security audit
- SCOPE
- Borrower and investor-facing web platform, all platform APIs, and full AWS cloud infrastructure, reviewed concurrently
- INDUSTRY
- DeFi, stablecoin private credit
Thirty-five findings across two layers
What the dual-track review found
Borrower and investor PII exposed through API responses without proper authorization checks.
Authentication gaps in financial transaction workflows enabling unauthorized operations.
Cloud infrastructure misconfigurations exposing internal services to the public internet.
Unprotected cloud storage resources potentially leaking transaction and user data.
IAM policy gaps in the cloud environment creating privilege escalation risk for internal roles.
Insufficient encryption for sensitive data in transit across platform components.
The platform launched with full security clearance across both the application and cloud infrastructure layers.
If this looks like your environment, it probably behaves like it too
Fintech platforms handling borrower or lender data.
Companies needing combined web application and cloud infrastructure coverage.
Startups seeking comprehensive pre-launch security clearance.
Questions engagements like this raise
Why test the application and the cloud infrastructure together?
Because a finding in one layer often depends on the other. An API authorization gap and a cloud storage misconfiguration can chain into a single exploit that neither test would fully explain alone.
What counts as a cloud configuration finding versus a web finding?
Web and API findings live in application logic: authentication, authorization, and data handling in the code your team wrote. Cloud findings live in how the infrastructure around that code is configured: network exposure, encryption, and IAM.
Is this the right scope for a pre-launch platform handling funds?
Yes. Combined coverage before launch is exactly the point: catching gaps in both layers before real user funds and borrower data are on the platform.
How long does a dual-track engagement take?
Typically three to four weeks running both tracks in parallel, followed by a retest cycle once remediation is complete.
Other engagements
Start with a scoped assessment
Tell us what you are securing. We reply with scope and next steps within one business day.
Prefer to see it first? Book a demo ↗
Already a CredShields One customer? Log in ↗