Project note
A year-long security engagement with a SaaS platform
An authorized penetration test identified a critical data-exposure issue on a SaaS CRM platform. It was disclosed responsibly and privately to the client. On the strength of that work, the client engaged RedShaw to security-test the full platform on an ongoing basis. Over more than twelve months, RedShaw reported over 400 issues across the entire product.
How it started
One authorized test, one serious finding
The relationship began as a scoped penetration test carried out under written authorization. During that test, RedShaw identified a critical data-exposure issue. It was reported privately and directly to the client, with the detail needed to act on it, and nothing about it was published. It is described here only in general terms, and it will stay that way.
What it became
A standing testing relationship, not a one-off scan
On the strength of that disclosure, the client engaged RedShaw to security-test the full platform on an ongoing basis. Reporting ran daily in the early phase, then settled into a weekly cadence as coverage widened. Over more than twelve months, RedShaw reported over 400 issues across the entire product.
How the testing worked
The value of this engagement was not one finding. It was a method that kept working, month after month, against a product that kept changing.
Full-product coverage
Testing was not confined to a login page or a single module. It worked across the product: application logic, permission boundaries, tenancy behavior, the API surface, and the workflows connecting them.
A cadence matched to the product
Reporting ran daily through the early phase, where coverage was widening fastest, then moved to a weekly rhythm that stayed in step with the product as it changed.
One disciplined disclosure process
Every issue took the same route: reproduce it, record the evidence, rank it by risk, and report it privately to the client with the detail needed to act on it. Nothing was published and nothing was disclosed elsewhere.
Written authorization throughout
The whole engagement ran under written authorization from the client, with scope and limits agreed and recorded. That applied to the first scoped test and to every month that followed.
Findings a developer could reproduce
Each report was written so the client’s own developers could confirm the issue independently, rather than take a description on trust.
Live multi-tenant conditions
The work ran against a live, multi-tenant SaaS product, where testing has to stay careful about other tenants, production data, and system load.
What this demonstrates
Sustained testing, not a point-in-time scan
Over 400 issues reported across more than twelve months is testing that kept finding things long after the easy findings ran out. That is a different discipline to a single scheduled test.
Full-coverage methodology
Reporting spread across the entire product rather than clustering in one area. Breadth of that kind is what methodical, full-coverage testing looks like in practice.
Disclosure handled properly
A serious finding reported privately and correctly is what turned one authorized test into a year-long engagement. Discipline around disclosure is part of the service, not an afterthought.
Trusted with a live platform
A client giving the same tester ongoing access to their entire product, month after month, is a more useful signal than any single report.
About this note
Why the client is not named
This note describes RedShaw’s work, not the client. The platform is referred to only as a SaaS CRM platform, and it stays that way. Security work is published anonymously by default: no client name, no product detail, no finding detail, and nothing specific enough to identify the platform. Clients are named only where they have agreed to it in writing.
What is not covered here
The client’s side of the story is theirs
Nothing here describes how the platform behaved, what the client chose to do with the findings, or what its security posture is today. Those are the client’s to discuss, not RedShaw’s. What this note records is the method, the cadence, and the discipline RedShaw brought to the work.
Related RedShaw services
Penetration Testing and Security Assessments
Authorized, scoped testing for web apps, APIs, and infrastructure, with risk-ranked findings, reproduction steps, remediation guidance, and retest on request.
Technical Consulting
Senior technical consulting for platform decisions, workflow tools, integrations, migrations, and practical operational systems.
Fractional CTO / Technical Advisory
Scoped technical advisory for teams making platform, vendor, architecture, and implementation decisions without a full-time technical lead.
Has your platform ever been tested independently?
If your product holds client, user, or payment data and nobody outside the team has genuinely tried to break it, start with a scoping conversation about what testing would sensibly cover.