One loose setting on a proxy path opened the admin side before launch
The report that says what it could not test is worth more than the one that looks complete.
A real-estate marketplace (Next.js, a Keycloak identity provider and a GraphQL API) asked for a security review before launch. The result was one chain that blocked the launch, and a list of gaps we put in writing.
The chain that blocked the launch
An internal proxy path allowed any website to make cross-origin requests to it. Through it a hostile page could read analytics and the admin surface, and under some conditions write to them.
No single line looked dramatic. A permissive cross-origin policy on an internal path is easy to leave in place during development, and it is the kind of thing that survives to launch.
What we ruled out
Twelve or more classes of attack were tested and found not vulnerable: SQL and NoSQL injection, template injection, reflected scripting, header injection, prototype pollution, XML external entities, host-header injection, and identity-provider enumeration across realms.
Saying what was clean is part of the report. A team about to launch needs to know where it can stop worrying as much as where it must start.
The gap we wrote down
The final audit pass listed what we had not covered, and the largest gap was that 10 of the 11 server-action ids in the front end had not been exercised. The report states it plainly instead of leaving the reader to assume everything was checked.
A coverage figure alone would have hidden that. The named gap tells the team exactly where the next day of testing should go.
The outcome
One critical, one high, eight medium, five low and six informational findings. The report says one change closes the critical chain, so the launch decision was a fix and a retest, not a rebuild.
What to take from it
- Look at the internal paths. A permissive setting there reaches the admin side.
- Report the clean results. They tell the team where to stop.
- Name what you did not test. A stated gap is better than a silent one.
Want a pre-launch security review that lists its own gaps?
We say what we tested, what was clean and what we did not reach. The first month is a trial.
