Secure Code Review Finds an Authorisation Gap That Automated Scanning Missed
A source-level review followed an authenticated request through shared application code and exposed a cross-tenant access path before release.
Client: Enterprise Software Organisation
The challenge
The Scanner Checked the Code. Nobody Had Traced Who Could Access the Data.
The development team had incorporated static application security testing into its pipeline, but its assurance process concentrated on known vulnerability patterns. The application authenticated users correctly. The unresolved question was whether every downstream service checked that a user was authorised to access the specific record requested.
- Authentication controls were tested more thoroughly than record-level authorisation.
- Multiple application functions relied on the same data-access layer, increasing the impact of a missed check.
- Automated scanning produced findings without establishing whether business-logic paths could be abused.
- Existing regression tests concentrated on successful requests from authorised users.
The solution
Follow the Request Through the Code, Then Prove the Access Boundary
Security Brigade combined static analysis with manual review of authentication, authorisation, data-access and background-processing code. The review concentrated on how user identity and tenant context travelled through the application, rather than treating individual scanner findings as the final assessment.
Our approach
- 01Map the critical application flows and identify where user identity, tenant context and resource ownership are established.
- 02Trace sensitive requests through controllers, shared services and database queries to find missing authorisation checks.
- 03Validate suspected access paths using controlled test accounts and document the affected code paths.
- 04Work with developers on server-side ownership checks, negative regression tests and a targeted remediation retest.
The results
Access Control Moved from Individual Features into the Shared Data Layer
The composite engagement demonstrates why authentication success is not proof of authorisation. The remediation approach made resource ownership an explicit condition of sensitive data retrieval and introduced regression tests for cross-tenant requests. The resulting evidence linked the vulnerable code path, corrective change and retest outcome.
Ready to discuss your security needs?
Talk to our team about a similar engagement for your organisation.
Request a scoping call