After a breach: the open doors found and closed in order of risk

Two production PHP applications for a resort membership club: a staff CRM and a member portal that takes payments. Neither had been assessed before the breach.

The systems had to stay up for members throughout, so every test had to be non-destructive. And a raw list of findings is useless. The club needed to know what to fix first.

1. Reviewed every file in both applications against the OWASP Top 10, and ran live, non-destructive attacks.
2. Found the most likely way in: files left in the public web root that should never have been there.
3. Recorded every critical and high finding with the exact code and route behind it. Most were injection and broken access control.
4. Checked every finding twice before it reached the report: once to confirm the code exists, once to challenge whether it was really reachable and how severe it was.
5. Ordered the work into hours, days, weeks and a longer project, and started with containment: the open doors were shut first.
6. Closed SQL injection across both applications, and tracked every remaining item to closure.

A quick first pass found only a fraction of what reading every file found. That gap is why we now quote security audits on full coverage only. We also deliver a one-page action list before the full report, so the first fixes start the same day.

PHP · OWASP Top 10 · Code audit · Non-destructive penetration testing