CASE STUDIES

Context

A DeFi lending protocol approaching mainnet launch asked for a full audit covering collateral management, liquidation logic, oracle integration, and cross-chain message handling. The team had internal tests but no prior external security review.

How We Worked

Manual review covered the business logic. Automated static analysis (Slither + custom rules) ran concurrently. We then forked Ethereum mainnet and replicated the reentrancy attack in a local environment — the PoC drained 100% of simulated collateral in one transaction. The team patched all criticals and highs within four days; we re-tested and issued a signed completion letter before launch.

Context

A Series A fintech preparing for SOC 2 Type II certification needed an external review of their AWS environment before the auditor's fieldwork window. The engineering team had grown fast; IAM policies had accumulated without a systematic review process.

DevSecOps Remediation

Beyond the point-in-time findings, we wired a continuous control: an AWS Config rule that fires an SNS alert whenever a new IAM policy is attached with a wildcard action. We also added a GitHub Actions step that runs a policy-linting check on every pull request touching IAM Terraform — criticals block merge, highs create a GitHub issue automatically.

The SOC 2 auditor saw the Config rule as satisfying CC6.3 (access control reviews) on an ongoing basis, reducing their sample testing burden significantly.

Context

A health data platform had passed SOC 2 Type I but was failing to keep up with evidence collection for the Type II window. The compliance team was manually exporting CSV files, screenshots, and access logs every quarter — a two-week exercise that was error-prone and couldn't keep pace with their monthly release cadence.

What We Built

We implemented a continuous compliance pipeline using Terraform and Cloud Run. Every 24 hours, a scheduled job pulls access logs, IAM change events, and system configuration snapshots, hashes each artefact, and pushes it to a locked GCS bucket with object versioning and retention policies. The same job writes a JSON manifest to the compliance platform's API.

For controls that couldn't be automated — annual security training completion, vendor contract reviews — we built a lightweight workflow in Jira that assigns tasks, collects sign-offs, and archives the evidence document automatically.

The Type II audit fieldwork was completed in three days rather than three weeks. The auditor's sampling was satisfied entirely by the automated artefact repository.

Context

A multi-chain infrastructure team was shipping weekly contract upgrades and API releases. Security reviews were happening ad hoc — sometimes before launch, sometimes after. One high-severity access control bug had slipped to mainnet and required an emergency pause-and-migrate. They wanted security baked into every deploy, not bolted on after.

Pipeline Architecture We Deployed

Every pull request into main now runs five sequential security jobs before a merge is allowed:

• SAST: Slither with custom detectors for their protocol-specific patterns; Semgrep for Node.js API layer
• Dependency scan: npm audit + Snyk for JavaScript; cargo-audit for any Rust tooling
• Secret detection: Trufflehog scans every commit diff — blocks if a private key or API token pattern is found
• Fuzzing delta: Foundry fuzzing runs 50,000 calls against any function touched in the PR diff
• RBAC regression: A custom script compares the proposed access control matrix against a signed golden file — any privilege escalation fails the check

Critical and High findings block merge with an inline PR comment explaining the finding, blast radius, and the specific line to fix. Medium findings create a labelled GitHub issue assigned to the author.

The first week after deployment, the pipeline caught a missing onlyOwner modifier on an upgrade function — a critical that would have gone to mainnet under the old process.