SECURITY VERIFICATION
Built to be secure — then tested like an attacker
TaxPin’s security doesn’t stop at “we built it.” We repeatedly tried to break it from an attacker’s point of view, and had it independently reviewed by an external firm.
Two layers of verification
We combine internal reviews that attack ourselves with an independent external assessment.
Internal adversarial review
Independent teams probed the code with real attack scenarios across multiple rounds, and closed findings structurally at the database and server layer.
External review — AEGISonar
An independent external assessment of our attack surface and web vulnerabilities via WebEASM’s AEGISonar.
Internal adversarial review — how we did it
Not “we coded carefully” — we actually tried to break in. Independent teams using different methodologies reviewed the code in parallel across multiple rounds, and each finding was confirmed only after independent attempts to refute its reachability.
Our method
Attack scenarios we tested
We actually attempted the following attacks and verified they are blocked at the database and server-code level.
✓Tenant-isolation bypass
Attempts to read or write another firm’s clients, documents, or requests. Not just reads — writes (INSERT/UPDATE) are also bound to the firm↔client relationship and blocked.
✓Vertical privilege escalation
Attempts to climb from staff→owner or client→firm member. Role decisions and invite claims are enforced at the server and database.
✓Invite-link hijacking
Attempts to claim an invite with a mismatched email. The login email must match the invited email.
✓MFA bypass
Attempts to reach data with a password alone. Once a factor is enrolled, the database requires an aal2 (two-factor) session.
✓Notification/email relay abuse & phishing injection
Attempts to inject forged login links through notification paths. Sender identity and link domains are pinned to trusted values.
✓Signup-funnel abuse
Anonymous mass calls to the signup API to break the service or squat firm addresses. Blocked via server routing, rate limits, and payment-session binding.
✓Secret exposure, XSS, open redirects
Checks for server secrets leaking to the browser, user input executing as script, and redirect abuse.
✓Inbound SMS webhook forgery
Attempts to forge inbound webhooks to flip SMS consent. Blocked by required signature verification.
Confirmed real issues were closed at the database-policy and server-code level, mostly before any real clients were onboarded.
External review — WebEASM AEGISonar
Internal review alone can leave blind spots, so we had an independent external assessment. WebEASM’s AEGISonar independently examined our externally exposed attack surface and web vulnerabilities.
External audit result · Overall grade 5 (Safe)
0 Critical/High/Medium findings, SSL/TLS secure, 0 external-link threats — view full results
An honest boundary
Security is a continuous process with no “done.” Our internal reviews are static-analysis and scenario based, complemented by the external AEGISonar assessment. As we scale to more clients, we keep expanding our testing. Rather than claim perfection, we choose to be transparent about what we verified and how.
Need a security review?
For assessment scope, results, or due-diligence materials, reach out anytime.