How an unauthorized "pentest" led to a full OWASP security audit of my SaaS
Yesterday, someone ran unauthorized security testing against StatusPage.me: scripted registrations, XSS payloads in form fields, and password reset abuse.
They didn’t get in. But they did trigger two real bugs: a couple of endpoints returned 500s where they should’ve returned 404s.
That was enough to push me into something I’d been postponing: a full OWASP Top 10 pass.
What I fixed (high level):
500→404 for missing records + sanitized error responses
added rate limiting for login + forgot-password
shortened admin JWT lifetime (30d → 4h)
removed debug logs that could leak sensitive session/JWT info
fixed 2FA backup code invalidation after use
locked down webhook URL validation (SSRF hardening across all channels)
added missing security headers globally
A new feature fell out of this:
✅ Domain-level registration blocklist (stored in Postgres + manageable via admin UI).
IP blocks are easy to rotate. Domains are stickier.
Takeaways for other founders:
"The attack failed" ≠ "no bugs"
Ship defense-in-depth, then audit anyway
Block abusive domains, not just IPs
Log hygiene in prod is a quiet liability
Short admin sessions cost almost nothing and reduce blast radius
Incident closed. Codebase better. Back to building. 🧑🏻💻
What’s your "minimum security checklist" before you ship a new SaaS feature?
