3D e-commerce configurator

This case study is deliberately anonymised. The engagement is covered by a five-year confidentiality clause and the intellectual property was assigned: neither the end client nor the precise nature of the defects fixed can be published. What follows describes the method, not the vulnerabilities.

In what context was this engagement carried out?

A manufacturer sells a highly configurable product through a web configurator with 3D rendering, to businesses and consumers alike. The platform existed, was running in production, and was accumulating defects nobody had connected to each other.

I came in twice: first a technical audit, then a three-month engagement whose initial scope matched that audit's conclusions exactly.

How is a useful audit built?

An audit that hands over a list of bugs is worthless. The client already has that list — it is precisely what made them call.

The work is tracing symptoms back to the two or three structural decisions they all follow from. Here, two were enough to explain most of the list: a misplaced trust boundary in the payment chain, and a storage choice that made any queryable source of truth for commercial documents impossible.

Once named, those two causes made the symptom list almost trivial: fixing one made six defects disappear at once.

What exactly was delivered?

Security phase. Every computation that commits money — amounts, trade discounts, shipping — moved back under the server's authority. Real confirmation of payments through a webhook rather than a browser redirect. Secret rotation and domain-restricted API keys.

Document phase. A centralised document store indexing quotes, invoices, orders and delivery notes, with a migration script for existing data. A search engine, reliable numbering, automatic re-indexing, and regeneration of documents after billing details change. The document controller is split into dedicated utilities — addresses, cart, pricing, delivery notes — because a monolithic generator becomes unreadable again by the third document type.

Cross-cutting hardening. Rate limiting, server-side sessions, structured logging. Without traces, a payment incident is impossible to unravel.

Sign-off. Nine functional tests out of nine, an automated suite, and an audit report delivered in two versions — one technical, one written in plain language for the client.

What was the contractual frame?

A three-month engagement under French law, through a British intermediation platform: a fixed phase with overrun penalties and a thirty-day warranty, then evolutions requested along the way. Two follow-on contracts came after the initial mission.

What did this engagement teach me?

An audit's value is not measured by the number of lines in its report, but by how many symptoms disappear when you fix what it pointed at. A list of thirty bugs handled one by one means thirty fixes and as many chances of regression. Two well-identified root causes mean two fixes.