Securing the software development lifecycle (SDLC) with the Reconmore scanner

Client

A software house building custom B2B web applications for business clients. The company’s currency is the trust of its enterprise clients — every vulnerability in released code risks damaging the reputation of those who commission the work.

Challenge

Even the best development teams make mistakes under time pressure. The client needed a final, hard line of defense before code went to production — independent of its own team and running continuously, not once a year.

Scope of work

• Reconmore continuous vulnerability scanning for production and test environments
• Infrastructure flaw detection: exposed .git directory (Critical) — a misconfiguration that allowed an attacker to download the application’s entire source code from the server
• Credentials leak (High): plaintext database credentials discovered
• Missing encryption (High): communication channels not secured with TLS
• XSS analysis in the code itself: Reflected Cross-Site Scripting (High) — an improperly encoded parameter whose exploitation could lead to phishing attacks on end customers, session hijacking, or even page content spoofing (an attack on the brand’s image)

How the engagement worked

Results and value for the client

Reconmore became a permanent part of the client’s release cycle — the final checkpoint before production. Catching the open .git directory and the XSS vulnerability protected the reputation of the software house and its clients. The cooperation has continued uninterrupted for 6 years; after the first 3-year contract, the agreement was extended for another 3 years.