How FellaRide closed every critical security gap before scaling
The situation
FellaRide is a community carpooling platform. It holds riders’ personal data and identity verification details, so trust is the product.
Before scaling, the team wanted to find and close security gaps across the app, the infrastructure and the cloud. Our first scans confirmed why that mattered: sensitive configuration was exposed in a testing environment, and services that should have been private were reachable from the internet.
The constraint
Every fix had to fit around FellaRide’s own development schedule. We agreed milestones up front for black-box testing, white-box testing, reporting and retesting, and delivered each one on time.
What we did
- Black-box testing. Attacked the platform from outside with no inside knowledge, the way a real attacker would.
- White-box testing and code review. Worked through the frontend and backend code and the architecture to find authentication flaws, input-validation gaps and misconfigurations.
- Cloud assessment. Reviewed IAM, access controls and network security, then tightened permissions and locked down exposed services.
- Fix and verify. Gave FellaRide a prioritized remediation roadmap, worked alongside their engineers on the fixes, then retested to confirm each one.
The result
Every critical vulnerability closed
100% of critical findings fixed and verified by retest.
High-severity findings: 3 to 0
The testing environment went from three high-severity findings to none.
160 scan observations addressed
Every observation across production and testing was addressed and retested.
Access locked down
Exposed services restricted. IAM policies, access controls and network rules tightened.
Admin login hardened
11 missing security headers added. Authentication and authorization strengthened to reduce the risk of unauthorized access.
Security is now a habit
FellaRide's engineering team now runs a structured, ongoing security review process.
“Rather than simply delivering a list of vulnerabilities, they took the time to explain real-world attack scenarios, business impact, and prioritization.”
“They treated our platform security as a shared responsibility, proactively guiding us through remediation and re-validation rather than just completing a checklist exercise.”
“When critical vulnerabilities were identified, they proactively escalated them and offered immediate guidance on remediation.”
Services involved
Scaling soon? Find your gaps before your users do. Book a free security audit.
Book a free audit →