Mobile App Security Outstaff Audit

Client:

A company providing veterinary services through a mobile platform

Industry:

HealthTech / Veterinary services

Focus:

Security audit of the mobile application and AWS before MVP launch

Main challenge:

Check the security level of key assets before release in an outstaffing format.

Market:

International

Services provided:

Mobile application pentesting, AWS pentesting, code security audit

Key Takeaways

Identified dangerous configurations and data leaks

Strengthened security before product launch

Used manual and automated testing

Found 26 vulnerabilities, including 4 critical

Delivered a remediation recommendations report

components checked

vulnerabilities identified

1.5

months of project duration

Nov 20, 2025

15 min

Is there value in a security audit before releasing an MVP? This case study confirms that there is. The company brought a Datami specialist into the developer’s team. He performed a pentest and code review of the mobile application and AWS, identifying critical vulnerabilities and risks for the MVP.

An international company is developing a mobile service for remote communication between veterinarians and their clients. The platform combines a mobile application with cloud infrastructure.

Cybersecurity is crucial for the company because the developer’s service processes users’ personal data, and any vulnerability may lead to data leaks, financial losses, or even disrupt the MVP launch.

Tasks and challenges

The client was preparing to launch the MVP. To prevent data loss and eliminate financial and reputational risks, it was necessary to conduct an external security assessment of the mobile application and AWS infrastructure.

The company decided to involve a Datami specialist to obtain an independent evaluation of the risk level and recommendations for its mitigation before the release.

Evaluate the security of the AWS infrastructure and the mobile application
Conduct a technical review of the code and critical configurations
Prepare a detailed report with recommendations for eliminating vulnerabilities

Mobile application pentest

Test the app’s security using automated and manual methods

AWS penetration test

Check the console, servers, and configurations for vulnerabilities

Code security audit

Analyze the software code to identify issues and improve security

Work in an outstaff format

The Datami specialist was integrated into the client’s internal team. This cooperation model ensured efficiency and transparent communication: the security assessment was performed without interrupting processes and with full control remaining on the client’s side.

For the pentest and code security audit, a White-Box strategy was applied. During the project, our expert combined automated tools and manual testing methods to achieve the most accurate and comprehensive result.

White-Box

Deep testing with full access to the code and configurations to identify vulnerabilities.

Results and recommendations

To assess the security of the cloud infrastructure and the mobile application, the Datami specialist used a White-Box strategy.

During the pentest and code security audit, 26 vulnerabilities of varying severity were identified: 4 critical, 7 high, 11 medium, and 4 low. Both technical issues and configuration errors were discovered, including:

data exposure,
unsafe settings,
incorrect administrator permissions,
exposed API keys in the code,
outdated, vulnerable modules and libraries,
storage of sensitive information in the source code.

Based on the security assessment, a report describing the risks was prepared. Each vulnerability was accompanied by specific recommendations, including:

configuring secure storage of keys in the code,
implementing two-factor authentication,
strengthening access control for configurations,
regularly updating third-party modules.

Key project takeaways

Thanks to the collaboration with Datami, the client quickly received a full risk assessment and a clear plan for improving security before the MVP release. This will help them successfully pass future audits and strengthen user trust.

This case study also demonstrates the effectiveness of the outstaff approach to cybersecurity testing: integrating an external specialist into the internal team made it possible to efficiently conduct an independent audit without halting development or expanding the staff.

Security status

No expertise

26 vulnerabilities identified, a report with remediation instructions prepared

Confidential data

Risk of leakage

Recommendations provided on 2FA, access policies, and key storage

Code protection

Vulnerabilities and secrets in the code

Error remediation plan prepared

Security Policy Audit for a Fintech Company

Seven key cybersecurity policies were reviewed and assessed
Regulations aligned with ISO 27001, DORA, GDPR, and NBG

Services:

Security policy and compliance audit

Nov 20, 2025

Security Testing of the DonorUA Medical Platform

A report with recommendations for strengthening security was provided.
No critical security threats were confirmed.

Services:

Web application pentest (Black-box)

Nov 18, 2025

Security Protocol for INOI

A personalized Security Protocol has been developed
The company's readiness for crises has been improved

Services:

Development of a Security Protocol – cybersecurity consulting

Nov 7, 2025

Back to all cases

Datami articles

Datami Newsroom

KillSec Ransomware Attacks Healthcare

The hacker group KillSec has recently been actively attacking the IT systems of the healthcare sector in Latin America and other countries — the attackers have already stolen dozens of gigabytes and nearly 95,000 files.

Nov 18, 2025

Datami Newsroom

Datami at MERGE Madrid and EBC 25

The Datami team attended MERGE Madrid and the European Blockchain Convention 2025 to share their expertise and witness how Web3 is evolving. This year, the focus shifted toward real-world solutions – security, auditing, and transparent standards.

Nov 13, 2025 3 min

Oleksandr Filipov: Security engineer at Datami, author of articles

Cyberattack Types

To effectively protect data and systems, it is important to understand what types of cyberattacks exist and how they work. In this article, we will look at the main types of attacks and figure out how to protect your business from them.

Nov 6, 2025 15 min

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on ak1-3.com.ua and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.