Find the holes before the hackers do
This fast-growing online electronics store processed hundreds of payments every day without ever seriously testing its security. We ran a full penetration test, the way an attacker would, then prioritized and fixed every flaw — before an incident could cost dearly in money and reputation.
- Client
- Confidential
- Industry
- E-commerce · Electronics
- Region
- Paris, France
- Context
- 30 employees, ~400 orders/day
- Services
- Penetration test · Security audit · Remediation
- Duration
- ≈ 4 weeks
Growth that draws attention… from the wrong people
The bigger an online store gets, the more of a target it becomes. The store had built its site fast, as it grew, without ever putting it through a real security test. Customer data, payments, admin accounts: everything rested on the hope that no one would look too closely.
- No penetration test since the site was created.
- Outdated dependencies and components with known flaws.
- Admin access without two-factor authentication.
- No response plan in case of a data breach.
What the penetration test revealed
We attacked the site in a controlled setting, following a recognized methodology (OWASP). Each vulnerability was classified by severity level.
Key vulnerabilities identified
| Vulnerability | Severity | Status |
|---|---|---|
| Injection on a search form | Critical | Fixed |
| Admin access without two-factor auth | Critical | Fixed |
| Customer data exposed by an API | Critical | Fixed |
| Outdated payment component | High | Fixed |
| Weak passwords allowed | Medium | Fixed |
| Missing HTTP security headers | Low | Fixed |
Fix fast, then fix for good
A report gathering dust protects no one. We supported the fixes, from emergency patching to deeper hardening.
- Patch the critical flawsDone
Immediate fix of the 4 critical vulnerabilities, in under 72 hours.
- Update componentsDone
Upgrade of vulnerable dependencies and the payment module.
- Harden accessDone
Two-factor authentication, password policy and least-privilege principle.
- Incident response planDone
Procedure and contacts defined in case of a breach, with tested backups.
A store that inspires trust, with proof
Beyond the fixes, the store now has a security posture it can demonstrate to its customers and payment partners.
We thought we were too small to interest hackers. Codally showed us otherwise — by finding flaws we’d never have seen. Today we sleep better, and we can prove it to our customers and payment partners.
When did you last test your security?
Better to find your flaws before someone else does. Let’s talk about an audit.