A healthcare technology provider asked Perfai Security to assess three patient-facing and billing applications that had run in production for over ten years. In under two days, our agents proved 17 distinct issues — including cross-tenant access to patient invoices, ledgers, and payments.
The highest-stakes software, built a decade ago
Healthcare apps carry some of the highest stakes in software. They handle protected health information and financial records, and they operate under strict regulatory obligations. When access controls fail, the consequence is not an inconvenience. It is a reportable breach.
The provider's three applications — a client billing portal, a payment processing portal, and a data portal — had each been in production for more than a decade. They were stable, mature, and supported by ongoing QA. Two of them also returned non-standard responses that mixed HTML and JavaScript inside API payloads, the kind of real-world messiness that defeats off-the-shelf scanners.
The team needed a definitive answer: can a user of one tenant reach another tenant's patients, invoices, or payments?
Custom handling for messy, real-world apps
Perfai deployed its autonomous agents against all three apps using only test credentials. Because two apps returned mixed HTML and JavaScript inside their responses, Perfai built custom authentication and response handling during the engagement and validated it against the live apps — so the agents could test pages and responses generic scanners cannot even read. Then every role was tested against every object and action.
Change one ID, see another facility's patients
Across the three applications, Perfai confirmed 17 distinct issues, 10 of them Critical or High severity. The dominant and most dangerous pattern was Broken Object Level Authorization (BOLA / IDOR, OWASP API1:2023): changing an identifier in a request returned data belonging to a different facility or patient.
Cross-tenant invoice access
Critical / HighAn authenticated user could download another facility's invoices by altering the identifier in the request URL.
Patient ledger & episode data
Critical / HighPatient-level financial and clinical episode records were reachable across tenant boundaries — a direct exposure of protected health information.
Broken authorization on payments
Critical / HighAuthorization gap on the live payment endpoint — the single highest-leverage flaw in the payment application.
Session hijacking & XSS
Critical / HighSession token capture and script injection in the billing portal opened the door to account takeover from the browser side.
Broken pagination & data exposure
Pagination leaked more records than the interface displayed, enabling cheap bulk data harvesting.
Missing rate limits, enumerable IDs
Sequential identifiers with no rate limiting made brute-force enumeration cheap and undetected against the live app.
Straight to the consequences that matter
For a healthcare provider, broken access control maps directly to the consequences that matter most. Cross-tenant access to patient and financial records is a HIPAA breach trigger. An authorization gap on a live payment flow opens the door to billing fraud. And unresolved Critical and High findings stall enterprise deals and erode trust at renewal — because healthcare buyers run their own security reviews before they sign.
Two reasons a decade of QA didn't surface it
BOLA doesn't show up in normal use
Broken Object Level Authorization only surfaces when you deliberately test one user's access against another user's objects, across every role and object — which manual testing rarely exhausts.
Mixed responses break scanners
Two apps returned mixed HTML and JavaScript inside their responses. Conventional scanners stop there. Perfai built the custom response handling needed to read those responses and test them fully.
What more than ten years of production and conventional QA had not surfaced, Perfai found, proved, and delivered in under two days.
A prioritized, exploit-backed remediation plan
The provider received a prioritized remediation list focused on the cross-tenant authorization flaws first, along with the custom authentication and response handling already built and validated against their apps — ready for continuous re-testing on every deploy.
In regulated healthcare workloads, maturity is not the same as security. Mature apps accrue authorization debt that only complete role × object × action testing — re-run on every deploy — can keep in check.
Know what a decade of QA never tested.
Autonomous agents that learn your app, prove the exploit, and ship the fix. No source code required.
Book a Perfai test →