The startup had done what early-stage fintech teams usually do: shipped fast, won interest, and deferred the unglamorous security work. That trade-off came due the moment their first major client, an enterprise with a formal security audit, appeared on the horizon. Passing that audit was now the gate to the company's most important deal, and the codebase was nowhere near ready for that level of scrutiny.

The gaps were structural, not cosmetic. API keys were hardcoded in source code, so anyone with repository access effectively held the keys to production services, and rotating a leaked key meant changing the code itself. There was no role-based access: an authenticated user was simply trusted with whatever they could reach. Sensitive data was stored unencrypted, readable to anyone or anything that reached the database.

Worst of all for an audit, there was no audit trail. Nobody could say with confidence who had accessed a record, changed a permission or moved money, because the platform kept no tamper-resistant account of its own history. For a payment platform courting enterprise clients, that silence was itself a finding.

We treated the audit's findings as symptoms and rebuilt the security layer underneath them rather than patching each item on the surface. The first move was getting secrets out of the code: every hardcoded API key was migrated to AWS Secrets Manager, so credentials are issued, stored and rotated centrally and never appear in source again. On top of that we introduced role-based access control, giving each account only the permissions its role actually requires.

Session security followed the same principle of limiting how much any single failure can cost. Authentication now runs on short-lived JWT tokens with a rotating refresh scheme, so a stolen token expires quickly and cannot be replayed indefinitely. Sensitive data was encrypted at rest with AES-256, closing the gap between a database breach and an actual data exposure.

Finally, we gave the platform a memory and a reflex. A tamper-proof audit log now records every significant action in a form that cannot be quietly edited, and rate limiting with anomaly detection watches traffic for patterns of abuse, flagging unusual behaviour before it becomes an incident. Together they turned the audit's hardest questions into ones the platform could answer from its own records.