Lending platform: web app and API secured ahead of an RBI audit
NBFC · customer web portal, 40+ REST APIs and an Android app
- An insecure direct object reference let one borrower view another’s loan documents
- Weak JWT validation allowed session tokens to be forged
- Admin API exposed without rate limiting
Fixes verified in a retest within two weeks, and a security testing certificate issued for the client’s audit file.
