Case study · Cybersecurity

A 1080° adversarial audit of our own software found 59 issues

Before advising anyone else on their security posture, we ran an adversarial audit against our own shipped software — and then fixed what it found, in tracked batches.

Work carried out on our own production systems. Published 2026-06-10.

Findings in one audit

59

IDORs closed in one push

6

Also fixed

MFA takeover, brute-force, DoS

Remediation batches shipped

4

The situation

• Software we had written and shipped ourselves, including a plugin handling third-party credentials and a platform handling user accounts and billing.
• The usual failure mode is that an audit produces a document and the document produces nothing — findings recorded, never remediated.

What we did

• A 1080° adversarial audit rather than a checklist pass — attacking our own code as an attacker would rather than confirming it matched a standard.
• Findings triaged into remediation batches so the fixes were tracked and reviewable rather than a single unreviewable commit.
• Regression tests written for the access-control failures specifically, because those are the ones that silently return to a codebase.

Outcome

• Fifty-nine findings from the audit, remediated across four tracked batches.
• Six insecure direct object references closed in a single push, alongside an MFA takeover path, brute-force protection and denial-of-service guards.
• Atomic owner-scoped writes and zero-trust caps added, with IDOR tests to stop the class of bug returning rather than the individual instance.
• A separate JWT signature-verification fix closed a critical billing IDOR on a sibling codebase.