Orbanne
Application testing and architecture review of a payments platform, run alongside the delivery team's sprints.
- Findings raised
- 41
- Fixed before launch
- 38
- Critical findings
- 3
- Mean time from report to fix
- 6 days
The mandate
A payments platform eleven weeks from its first live merchant, built by a team of nine who had never shipped something regulated. They wanted a penetration test. What they needed first was someone to read the architecture.
What we did
We ran alongside their sprints instead of waiting for a code freeze. Findings went into their own tracker the day we confirmed them, with a proof the engineer could reproduce locally — not a PDF that would arrive after the launch date.
Three findings were critical. One of them was an authorisation check that ran on the client, which is the kind of thing an architecture review catches in an afternoon and a penetration test catches expensively, three weeks later.
What changed
Thirty-eight of forty-one findings were closed before the first merchant went live. The three that were not are documented, accepted by their risk committee and scheduled — which is a legitimate outcome, and a more honest one than a report claiming everything was fixed.
Mean time from report to fix was six days. That number is the point: it is what you get for testing during delivery instead of after it.