Case studies: real defects we found, and what they would have cost

• 
  • Public safety
  • Clients

  Fixed on Android, still open on iOS: what retesting 13 medium findings showed

  For product owners and CTOs who ship one app on two platforms.

• 
  • Property software
  • Clients

  Would your app hold at 240 users? A load test found its production autoscaling could not scale

  For CTOs and heads of platform at companies running customer apps on Kubernetes.

• 
  • Retail
  • Money

  The new store was ready to launch. The basket was still on the old platform.

  For COOs and e-commerce leads about to move a store to a new platform.

• 
  • Finance
  • Money

  One payments partner could use another partner’s verified sender to fund transfers

  For CTOs and security leads at platforms that move money for partners.

• 
  • Public safety
  • Compliance

  Could a stranger read a rescue request? Ten high-severity findings in an SOS app, retested

  For product owners and CTOs releasing safety-critical mobile apps.

• 
  • Finance
  • Clients

  Your API errors are a promise to your customers. On a signing API, none of the three held

  For CTOs and API owners at fintech infrastructure companies whose customers build on their error responses.

• 
  • Healthcare
  • Compliance

  A patient record could be claimed with the wrong name and date of birth

  For heads of QA and product at digital health companies.

• 
  • Finance
  • Compliance

  An account that should see nothing got client data from eight endpoints

  For CISOs and CTOs at platforms that hold client and portfolio data.

• 
  • SaaS
  • Money

  452 scanner findings and six criticals: which ones can actually hurt you?

  For CTOs and security leads who receive scanner reports and have to decide what to fix first.

• 
  • Finance
  • Clients

  A bad request came back as ‘success’, in four subsystems of a wealth platform

  For CTOs and heads of engineering at fintech and wealth platforms that expose an API to clients or partners.

• 
  • Our own products
  • Operations

  A cleanup button would have deleted three quarters of a photo library, and no photo was broken

  For owners and operations leads who give staff a button that deletes in bulk, and the teams that build it.

• 
  • Our own products
  • Operations

  Absent 11 days, charged for 10: when one leave rule lives in twelve places

  For heads of HR technology and engineering at companies that calculate leave, overtime or billable time.

• 
  • SaaS
  • Security

  Two weak points in a business app chain into account takeover, while tenant isolation held

  For CTOs and heads of QA at SaaS companies whose customers share one platform.

• 
  • Property software
  • Security

  One loose setting opened the admin side of a property marketplace before launch

  For CTOs and product owners about to launch a customer-facing web platform.

• 
  • Healthcare
  • Security

  A captured request could be replayed against any endpoint of a care-sector app

  For CTOs and CISOs at care and health-software companies that rely on a custom security control.

• 
  • Healthcare
  • Security

  Is your health app’s source code public? A review found 15 source maps anyone could read

  For CISOs, CTOs and heads of QA at health-software companies who buy security testing.

• 
  • AI software
  • Clients

  Before an AI agent answers your phones: what rounds of real calls found

  For owners of service businesses and the teams that put a voice agent in front of customers.

• 
  • Our own products
  • Clients

  Your booking system says the confirmation was sent. Can it even record a failure?

  For owners and operations leads at appointment-based service businesses, and the teams that build their booking software.

No case study matches both filters. Clear one to see more.