Copilot-Coded Outsourced Apps Passed QA with 2,216 Unseen Vulnerabilities

COMPANY DESCRIPTION

A U.S.-based ERP platform used an outsourced team with AI coding tools like Copilot to speed up development. While the approach accelerated delivery across multiple apps, it introduced critical security gaps that went undetected.

Perfai Security's Role

Autonomous app testing across 1,899 endpoints. Exposed paths including financial records, employee PII, procurement workflows, business logic endpoints, and document storage. All flagged and auto-fixed by Perfai Security's agentic models.

App Count

Endpoints

1,899

Vulnerabilities

2,216

Critical

526

High

1,102

What we found, in plain English

Anyone could pull invoices, transaction logs, and budget details without logging in. A competitor or a curious outsider could reconstruct the company's finances from data that was never meant to leave the building.
Employee personal data and payroll information was reachable through an unprotected API. Names, salaries, and performance reviews sitting in the open are an immediate privacy and employment-law problem.
A broken authorization check let any signed-in user act as an administrator. That means editing vendor contracts and purchase orders, or altering business records, with no one able to tell who did it.

Full technical findings

Exploitable Endpoints & Risks

Financial Records
Invoices, transaction logs, and budget details
Employee Data APIs
PII, payroll, and performance data
Procurement Workflows
Vendor contracts, purchase orders, etc.
Access Control & Authentication Bypass
Broken authorization
Business Logic Endpoints
Altering and injecting data
Document Management
Exposed storage paths
Mobile Mirrors
Redundant mobile endpoint protection

Perfai Security Testing Categories

OWASP API Security Top-10 List
OWASP Web Top-10 List
Perfai Security Next-Gen Top-30 List
OWASP Business Logic Top-10 List
OWASP Mobile Top-10 List
OWASP AI Agent Top-10 List
RBAC

Estimated Breach Cost With:

50 Customers | $535,000

See what Perfai Security finds in your app

Paste a URL. Get a free security report in minutes.

Start Free →