VAPT
Closing critical payment-flow flaws for a Pune fintech
A grey-box web and API penetration test uncovered authorisation flaws in the disbursement flow before a major partnership launch.
Client
Digital lending platform (anonymised)
Duration
2 weeks
23
Issues reported
4
Critical / high
12 days
To full remediation
The challenge
The platform was weeks away from onboarding a large NBFC partner and needed independent assurance over its loan disbursement and KYC APIs. No external test had ever been performed.
What we did
- Grey-box testing of the customer portal, admin console, and 60+ REST endpoints
- Authentication, session, and role-boundary testing across four user types
- Business-logic abuse testing on disbursement, refund, and KYC workflows
Key findings
Critical
Broken object-level authorisation allowed one borrower to read another's KYC documents.
High
Disbursement amount could be tampered client-side and was not re-validated server-side.
High
Admin console accessible without MFA from any IP address.
Medium
Verbose API errors leaked internal stack traces and database identifiers.
Remediation
- Server-side ownership checks added on every object-scoped endpoint
- Amount and status transitions re-validated against the ledger of record
- MFA and IP allow-listing enforced on all administrative access
- Centralised error handler introduced to strip internal detail