Compliance Free audit

How FellaRide closed every critical security gap before scaling

How Triotech Systems helped FellaRide, a Canadian carpooling platform, close 100% of critical vulnerabilities before scaling.

FellaRide (Redefine Technologies Inc.)MobilityCanada5-month engagement
100%of critical findings closed and verified by retest
3→0high-severity findings in the testing environment
160scan observations addressed and retested
/situation

The situation

FellaRide is a community carpooling platform. It holds riders' personal data and identity verification details, so trust is the product.

Before scaling, the team wanted to find and close security gaps across the app, the infrastructure and the cloud. Our first scans confirmed why that mattered: sensitive configuration was exposed in a testing environment, and services that should have been private were reachable from the

internet.

/constraint

The constraint

Every fix had to fit around FellaRide's own development schedule. We agreed milestones up front for black-box testing, white-box testing, reporting and retesting, and delivered each one on time.

/what-we-did

What we did

  1. Black-box testingAttacked the platform from outside with no inside knowledge, the way a real attacker would.
  2. White-box testing and code reviewWorked through the frontend and backend code and the architecture to find authentication flaws, input-validation gaps and misconfigurations.
  3. Cloud assessmentReviewed IAM, access controls and network security, then tightened permissions and locked down exposed services.
  4. Fix and verifyGave FellaRide a prioritized remediation roadmap, worked alongside their engineers on the fixes, then retested to confirm each one.

How each finding was closed

  1. 1Found in black-box or white-box testing
  2. 2Ranked by real-world impact
  3. 3Explained with an attack scenario
  4. 4Fixed together with FellaRide's engineers
  5. 5Retested and verified closed
/result

The result

Every critical vulnerability closed100% of critical findings fixed and verified by retest.
High-severity findings: 3 to 0The testing environment went from three high-severity findings to none.
160 scan observations addressedEvery observation across production and testing was addressed and retested.
Access locked downExposed services restricted. IAM policies, access controls and network rules tightened.
Admin login hardened11 missing security headers added. Authentication and authorization strengthened to reduce the risk of unauthorized access.
Security is now a habitFellaRide's engineering team now runs a structured, ongoing security review process.
/in-their-words

In their words

“Rather than simply delivering a list of vulnerabilities, they took the time to explain real-world attack scenarios, business impact, and prioritization.”

Manmeet, FellaRide

“They treated our platform security as a shared responsibility, proactively guiding us through remediation and re-validation rather than just completing a checklist exercise.”

Manmeet, FellaRide

“When critical vulnerabilities were identified, they proactively escalated them and offered immediate guidance on remediation.”

Manmeet, FellaRide
/technology

Technology

Testing
Black-box and white-box penetration testing
Review
Secure code review, frontend and backend
Cloud
IAM, access control and network security assessment
/related

Related case studies

All case studies
E-commerceTilton Coffered Ceilings
4 to 0
outages a day, none in 4 years

How Tilton went from 4 outages a day to zero and cut hosting costs in half

Read case study
SaaSEnterprise
99.99%
uptime

How a construction SaaS took releases off developers’ machines and cut critical cloud risks to zero

Read case study
/free-audit

Find out what your stack is hiding.

Scaling soon? Find your gaps before your users do. Book a free security audit.

Book your free audit Talk to an engineer