One engagement
A UK tax platform, built by an outside development shop. This is the whole sequence, with the client anonymised and the finding detail withheld.
Day one
Testing an ordinary customer account with no active subscription, four areas of the application answered normally instead of refusing. One of them accepted a live tax return submission.
The paywall was enforced in the interface, not on the server. Anything that went straight to the API skipped it.
Within 72 hours
Reported the same day with reproduction steps, split into a plain English summary for the owner and a technical fix list for the developers.
Their team shipped a server side subscription check across the endpoints named in the report. Credit where it is due: that was the right fix, and it was quick.
Three days later
We went back and tested it ourselves rather than taking the word for it. All four areas now refuse a non paying account.
We also registered a brand new account the client had never seen, to rule out a patch that simply blocked the two accounts named in the report. It refused that too, so the fix is real and it applies to everyone.
Same visit
While confirming the fix, we checked the endpoints next to the ones they had patched. Five more of the same class were still reachable by an account with no subscription.
That is the finding that matters, and it is not a criticism of their developers. They fixed exactly what the report listed. Nobody asked the next question, which is what else has the same lock missing. That question is the job.
Overstating a finding is the fastest way to lose a technical audience. Here is where the limits of this one sit.
No. We tested specifically for it and the walls between customers held. An account could reach paid features it had not paid for, but it could not reach another customer's records. Calling this a data breach would have been wrong and we did not.
Medium, not critical. On a test account the areas concerned were empty, so the practical impact was limited. We graded them that way in the report rather than inflating them.
Not named, here or anywhere else. The finding detail, the reproduction steps and the platform stay private. A security consultant who publishes their client's vulnerability history is not one you should hire.
The question is what sits next to it. That is a Build Review, £2,500, about two weeks.
If that is a bigger step than you want to take today, start with the free one. We run your fraud prevention headers against HMRC's own validator. Ten minutes, no access needed, nothing to sign.