Remediating a critical access-control vulnerability
Sole remediation of a production inventory platform following an external security audit, for an international logistics operator
Delivered in August 2026
- 281/281
- API tests passing
- 728 Ko
- shipped bundle, under a hard 1 MB budget
- 0
- remaining dependency vulnerabilities
The context
An inventory management platform already running in production, supporting the operations of an international transport and logistics operator. Java / Spring Boot API, Angular front end, continuously delivered through a GitLab CI pipeline to a dedicated server.
The problem
A security audit run by an external team uncovered a critical broken access control flaw: the server enforced no role checks. Security relied entirely on the Angular interface hiding buttons — a control bypassed by calling the API directly. A read-only account could create administration roles, create inventory items, and list every user account, including administrators.
What I did
I handled the entire remediation single-handedly, on an application already running in production. The root cause was traced to the Spring Security configuration, where no authorisation was actually enforced, then reworked in depth on the server side — access control no longer depending on the interface. Fixes spanned both API and front end, and every release was validated against the automated test suite and the performance budget before being pushed to production.
The outcome
The fix closed an access path that exposed the platform to data theft, injection and direct API exploitation by any authenticated account, however limited its privileges. The remediation was deployed to production on 18 August 2026.
Technologies
- Java
- Spring Boot
- Spring Security
- Angular
- GitLab CI/CD
- OWASP ZAP
- gitleaks
- Docker
Let us talk about what you want to build
A question, a project, or simply a conversation: write to me.