Enterprise customers buy security first. When a penetration test came back with 15 findings, I closed 13 of them the day after the test window ended. When a critical Next.js flaw was being used against our production website, I patched it while the attempts were still coming in.
Tokens valid for 30 days, no server-side logout, no idle timeout, unlimited sessions, and a PDF upload that could carry script.
Hour-long tokens, an 8-hour idle timeout, a 5-session cap, server-side logout, and uploads checked by content, not by name.
The problem
A pentest of our trial environment (24 July – 4 August 2026) found 15 issues: 4 high, 9 medium, 2 low. Days earlier, attackers had tried to use a critical React Server Components flaw against our production website to install a crypto-miner.
The idea
Fix by class, not by ticket. Most findings shared a root cause, such as session handling or upload trust, so one well-designed fix could close several at once.
How I did it
- Contained the website attack: the read-only filesystem and non-root container had already stopped the payload, so I patched Next.js and React within the same major version to avoid a risky upgrade mid-incident.
- Rebuilt sessions: a server-side session registry, logout that actually ends a session, an 8-hour idle timeout, a 5-session cap, and tokens that expire after an hour instead of 30 days.
- Closed the upload hole: content types decided by the server, attachments forced to download, and magic-byte and polyglot checks on every file.
- Added rate limits on one-time passwords (5 tries per 15 minutes) and on AI questions (20 a minute), security headers in 5 services, and fixes for account enumeration and clickjacking.
- Before launching connectors, found and closed four ways one company could reach another’s data, including a SharePoint path trick that could list someone’s OneDrive.
- Recorded two findings as decisions rather than bugs: MFA was accepted as a known risk, and moving tokens out of browser storage was deferred.
The impact
Every medium and low finding and half of the high ones were closed within a day of the report. The production website was patched while the exploit attempts were still live.
Defence in depth is boring until the day it isn’t. The read-only container is what made the incident a patch instead of a breach.