The API behind the app was leaking data and inventory through the front door.
How object-level authorization and missing rate limits let attackers scrape data and abuse business logic at scale.
THE CHALLENGE
A high-traffic e-commerce platform with web and mobile clients had built most of its functionality on a shared REST/GraphQL API. Growth had outpaced security review of those endpoints, and the team was concerned about scraping, coupon abuse, and data exposure, the kind of business-logic attacks that don’t show up in a vulnerability scan.
THE ENGAGEMENT
Cybros ran an API penetration test alongside a mobile app assessment of the iOS/Android clients, focusing on the OWASP API Security Top 10 and business-logic abuse across both the app and its backend.
WHAT WE FOUND
The API returned far more data than the clients displayed, and object-level authorization gaps let one customer read another’s orders. Combined with no rate limiting, an attacker could quietly scrape the customer base and manipulate inventory and pricing logic.
BOLA / IDOR on order and profile endpoints
Cross-customer data access
Excessive data exposure in API responses
PII scraping at scale
No rate limiting on search / checkout
Inventory & pricing abuse, scraping
Coupon logic could be replayed
Discount abuse
Secrets bundled in the mobile build
Extractable API keys
THE OUTCOME
The team trimmed API responses to only what clients need, enforced object-level authorization, added rate limiting on sensitive endpoints, hardened the coupon logic, and moved secrets out of the mobile build. Retest verified the High and Medium findings closed. The platform measurably reduced automated scraping traffic afterward.
“We thought our API was an internal detail. Cybros showed us it was the actual attack surface.”
VP Engineering, E-commerce Platform
READY WHEN YOU ARE
Test your e-commerce platform systems the same way.
Book a free 30-minute scoping call, or download our sample report first.