Entire subscriber table open on the public internet, closed and re-verified mid-engagement
Authorized external red team, black-box, active probing against live production. Anonymized.
Who we worked with.
A consumer-facing SaaS product that collects personal profile data from the people who sign up for it. Small production estate: a single-page web application on a managed hosting platform, backed by a hosted cloud database and a transactional email service.
Anonymized. No client names, people, domains, addresses or locations are published.
The question we were asked.
The product holds personal records for everyone who enrols. The question for the assessment was direct: could an outsider with no account reach that data, and could the brand be used against the same people it serves?
Assessment modules used.
Authorized external red team, black-box, active probing against live production.
External red team
Production web application and its public JavaScript bundles.
Cloud database review
The hosted cloud database behind the application.
Email authentication
SPF, DKIM and DMARC posture for the primary domain.
API route discovery
Application API routes discovered through bundle analysis.
Passive content review
Content backend reviewed passively only.
Severity, validated.
- CriticalThe application's cloud database key was published inside its own public JavaScript. Any anonymous visitor could read the full subscriber table and reassign records.
- CriticalEmail from the primary domain could be freely impersonated (DMARC monitor-only, no DKIM signing).
- HighEight High findings, including stored cross-site scripting, no account lockout, privilege fields accepted at sign-up, client-side-only dashboard gating, and an unauthenticated AI endpoint.
What changed.
The two database Critical findings were remediated during the engagement and re-verified live three days after testing began. The remaining Critical (email impersonation) was left open at report time as the single priority action, with a sequenced DNS fix supplied.
Testing. Database exposure and the end-to-end chain confirmed against canary records.
Client applied row-level security to the exposed table.
Re-verified live: anonymous read and insert closed; finding, fix and re-test evidence shipped in the report.
What the client received.
- Validated findings report with fix and re-test evidence
- Seven refuted hypotheses documented
- Live re-verification of the database fix
- Sequenced DNS fix for email impersonation
- End-to-end chain demonstration
Prepared by TitanDef offensive security team
Find out what an adversary already sees.
Focused engagements run 5 to 7 business days, with a 72-hour first-findings commitment. Powered by frontier AI models; every finding validated by a senior human.