One account.
Another customer’s data.
A flaw in Chatwoot’s filter API let an authenticated user read across tenant boundaries, exposing other accounts’ emails, password hashes, and API tokens.
Application security
Authorization
Tenant isolation
Authorization reviews
for B2B SaaS.
I review how your application controls access to customer data. Across your APIs, MCP servers, and the AI agents you’ve connected to them.
Discuss a reviewSelected findings
Public reports and
upstream fixes.
One account.
A bit of background
Before this, I built SaaS companies.
I founded Percy, the visual testing platform acquired by BrowserStack, and Respondly, acquired by Buffer. I’ve also led an authorization overhaul for a B2B SaaS platform, rolling tenant isolation through 45+ data models and designing its access-rules system.
I ran the bug bounty programs at all three companies, so I know what crowdsourced testing and pentests turn up, and where they stop. Most of it is the surface of the running app. The cross-tenant and privilege-escalation bugs are in the code, so that’s where I work now: reading it with your engineers and testing whether the access checks hold up.
Working together
Fixed scope and price.
Usually 1–2 weeks.
Authorization &
Cross-Tenant Isolation Review
For teams moving upmarket, adding a new API, or giving an agent access to customer data. I read the database queries, access checks, and tenant boundaries, then test whether one account can reach what belongs to another.
- The review
- A ranked findings report with reproducible steps and recommended fixes. A walkthrough with your engineers.
- After the fixes
- A short independent attestation you can share with a prospect’s security team. I can also help implement the fixes or pair with your engineers.
Code-level review of APIs, MCP servers, and multi-tenant SaaS. Cloud and runtime infrastructure are out of scope.
Also: supply chain & release integrity
If the same review raises questions about how your code ships, I can cover dependency intake, GitHub Actions, release provenance, and publish credentials.
From a client
“I thought we had it pretty locked down but he was still able to find a few critical issues that I’m happy we were able to get fixed before anyone else found them.”