Secure code review of payment flow for Coinsure
Manual review of payment and payout code paths before a regulatory audit. A case study by James O'Connor, Penetration Tester & Security Consultant.
Challenge
Coinsure, an insurance comparison site, was preparing for a regulatory audit and needed assurance that its payment code handled money, secrets and retries safely.
Solution
I reviewed the payment, refund and payout code paths line by line, focusing on race conditions, idempotency, secret handling and logging, and walked the team through every finding.