Mudbase Security Audit & Penetration Test
An ongoing, deep security review and live penetration test of our own BaaS platform's backend — authentication, session management, multi-tenant data isolation, WebSocket/Socket.IO channels, webhook signature verification, wallet/custodial transaction paths, and serverless Function execution. Found and fixed critical issues including a 2FA-bypass path through the refresh-token flow, cross-tenant WebSocket subscription leaks, a serverless Function sandbox escape, and multiple cross-tenant IDOR vulnerabilities in wallet and chat data.
Mudbase Security Audit & Penetration Test
An ongoing, deep security review and live penetration test of our own BaaS platform's backend — authentication, session management, multi-tenant data isolation, WebSocket/Socket.IO channels, webhook signature verification, wallet/custodial transaction paths, and serverless Function execution. Found and fixed critical issues including a 2FA-bypass path through the refresh-token flow, cross-tenant WebSocket subscription leaks, a serverless Function sandbox escape, and multiple cross-tenant IDOR vulnerabilities in wallet and chat data.
Technologies Used
Results
Dozens of critical/high-severity findings fixed — auth bypass, IDOR, SSRF, RCE-class sandbox escape, secret leaks