TaxPinTaxPin

SECURITY VERIFICATION

Built to be secure — then tested like an attacker

TaxPin’s security doesn’t stop at “we built it.” We repeatedly tried to break it from an attacker’s point of view, and had it independently reviewed by an external firm.

Tenant isolationPrivilege escalationMFA bypassInvite hijackingSignup abuseXSS · secretsAttack surface

Two layers of verification

We combine internal reviews that attack ourselves with an independent external assessment.

🧪

Internal adversarial review

Independent teams probed the code with real attack scenarios across multiple rounds, and closed findings structurally at the database and server layer.

🛰️

External review — AEGISonar

An independent external assessment of our attack surface and web vulnerabilities via WebEASM’s AEGISonar.

Internal adversarial review — how we did it

Not “we coded carefully” — we actually tried to break in. Independent teams using different methodologies reviewed the code in parallel across multiple rounds, and each finding was confirmed only after independent attempts to refute its reachability.

Our method

Multi-angle teamsRLS & authorization (tenant isolation), server logic (STRIDE), client & web (OWASP), and data/storage regression — four angles reviewing from different perspectives at once.
Repeated roundsNot once, but multiple rounds of review → fix → re-review. Every new capability (self-signup, billing, free trial) triggered another pass.
Adversarial verificationEach finding was independently challenged by multiple reviewers, so only genuinely reachable issues were confirmed and exaggerated ones were filtered out.
Structural fixesNot band-aids — findings were closed in structural layers: row-level security (RLS), triggers, and server-side gates, with a tracked review-and-fix history.

Attack scenarios we tested

We actually attempted the following attacks and verified they are blocked at the database and server-code level.

Tenant-isolation bypass

Attempts to read or write another firm’s clients, documents, or requests. Not just reads — writes (INSERT/UPDATE) are also bound to the firm↔client relationship and blocked.

Vertical privilege escalation

Attempts to climb from staff→owner or client→firm member. Role decisions and invite claims are enforced at the server and database.

Invite-link hijacking

Attempts to claim an invite with a mismatched email. The login email must match the invited email.

MFA bypass

Attempts to reach data with a password alone. Once a factor is enrolled, the database requires an aal2 (two-factor) session.

Notification/email relay abuse & phishing injection

Attempts to inject forged login links through notification paths. Sender identity and link domains are pinned to trusted values.

Signup-funnel abuse

Anonymous mass calls to the signup API to break the service or squat firm addresses. Blocked via server routing, rate limits, and payment-session binding.

Secret exposure, XSS, open redirects

Checks for server secrets leaking to the browser, user input executing as script, and redirect abuse.

Inbound SMS webhook forgery

Attempts to forge inbound webhooks to flip SMS consent. Blocked by required signature verification.

Confirmed real issues were closed at the database-policy and server-code level, mostly before any real clients were onboarded.

External review — WebEASM AEGISonar

Internal review alone can leave blind spots, so we had an independent external assessment. WebEASM’s AEGISonar independently examined our externally exposed attack surface and web vulnerabilities.

5

External audit result · Overall grade 5 (Safe)

0 Critical/High/Medium findings, SSL/TLS secure, 0 external-link threats — view full results

An honest boundary

Security is a continuous process with no “done.” Our internal reviews are static-analysis and scenario based, complemented by the external AEGISonar assessment. As we scale to more clients, we keep expanding our testing. Rather than claim perfection, we choose to be transparent about what we verified and how.

Need a security review?

For assessment scope, results, or due-diligence materials, reach out anytime.

Portal Login