Web platformsMarketplace security audit and maintenance
46 API routes reviewed, 3 critical security holes closed
An access-control and payment-integrity audit of a multi-vendor marketplace for the Pakistan market, followed by fixes and ongoing maintenance.
- HighAdmin routes missing an authorization checkFixed
- HighOrder totals trusted from the browserFixed
- MediumSessions not revoked on password changeFixed
- MediumProduct search slow without an indexFixed
- LowVerbose error messages in productionIn progress
Illustrative screen with sample data. Client data is not shown.
How it works
- Every API route 46 reviewed
- Written findings Severity, impact and fix for each
- Fixes 11 routes corrected
- Maintenance Ongoing contract
- Client
- An e-commerce marketplace
- Year
- 2026
- Platforms
- Web
- Built with
- Next.js, TypeScript, PostgreSQL, Redis
- Team
- Awais Tariq
The marketplace has a customer storefront, a vendor panel, an admin panel and payments through cards, JazzCash, Easypaisa and cash on delivery, backed by a double-entry ledger. We were brought in to check whether it was safe to grow.
What we did
- Reviewed access control and payment handling on all 46 API routes
- Wrote up every finding with its severity, its impact and the fix
- Fixed 11 routes, including the three critical ones
- Flagged the issues that need new infrastructure, with a plan for each
What we found
Three critical problems, all fixed. An admin check that could be bypassed, a password reset that did not verify its code, and a wallet top-up that could add balance without a payment and left the ledger unbalanced. Each was fixed in place, without a rebuild, and wallet movements now always post balanced entries.