SiriusOne:
Enterprise Security Audit for Retail Platform
Comprehensive OWASP-based audit delivering system-wide visibility, trust, and long-term DevSecOps maturity.Client & Project Overview
Business Problem
- Validate code quality and security across frontend and backend
- Prevent secret exposure in CI/CD pipelines
- Evaluate WAF configuration and real-world threat resilience
- Audit open-source dependencies and license compliance
- Create a clear 6-month roadmap for DevSecOps improvement
"Our mission was to bring clarity and control into every layer of the system. We approached the audit as engineers, not inspectors — focusing on prevention, precision, and long-term resilience."
Eugene Fateev
Lead Cybersecurity Engineer, SiriusOne
Tech Stack
CI/CD: GitLab Pipelines
Code Analysis: SonarQube, ESLint, PHPStan
Testing & Pentest: Burp Suite, OWASP ZAP, Intruder
Dependencies: Docker Scout, Composer Audit
Secrets & SCA: Gitleaks, Dependency-Track
#Cybersecurity
#Audit
#DevSecOps
Project Timeline
Duration
7 days
Effort
160 hours
Code & SBOM Review
Days 1–2
Manual code review, performance checks, and generation of a full Software Bill of Materials (SBOM).
Testing & Vulnerability Scan
Days 3–5
Dynamic analysis, dependency scanning, and manual penetration testing across core application modules.
Validation & Retesting
Day 6
Verification of WAF policies, vulnerability retesting, and cloud configuration validation.
Reporting & Strategy
Day 7
Delivery of the complete audit report, risk matrix, and long-term DevSecOps roadmap.
Team involved
Cybersecurity Architect
Led OWASP and ASVS validation, ensuring enterprise-grade compliance.
DevSecOps Engineer
Audited CI/CD pipelines, secret management, and infrastructure automation.
Software Security Auditor
Performed code analysis, SCA validation, and penetration testing.
Delivery Manager
Ensured process transparency, communication, and stakeholder alignment throughout the audit.
Solution Overview
Source Code Review & Static Analysis
Frontend and backend code inspection using SonarQube and PHPStan, identifying vulnerabilities and structural issues.
Dependency & License Verification (SBOM)
Generation of full SBOM and analysis of open-source packages, licenses, and security risks.
CI/CD Pipeline & Secrets Audit
Validation of GitLab pipelines, secret storage, and automation processes using Gitleaks and SCA tools.
External Testing & DAST Assessment
Dynamic testing with Burp Suite and OWASP ZAP simulating real attack scenarios.
WAF Configuration Review
Assessment of WAF behavior under simulated threats to confirm OWASP Top 10 resilience.
Executive Report & Long-Term Roadmap
A structured 3–6 month DevSecOps improvement plan, aligned with business priorities.
Results
Full audit delivered in 7 days
The complete security assessment — from source code review and dependency analysis to WAF validation and executive reporting — was delivered within one week. This allowed the client to gain immediate visibility into security risks without slowing down release cycles or operational workflows.
100% OWASP ASVS and Top 10 coverage
All application layers, CI/CD pipelines, and external interfaces were validated against OWASP Top 10 and ASVS requirements. The audit confirmed compliance gaps, verified existing controls, and established a unified security baseline across development, infrastructure, and delivery processes.
60% CI/CD risk exposure reduction
Critical weaknesses related to secret handling, access control, and pipeline configuration were identified and remediated. As a result, the client significantly reduced the risk of credential leaks, unauthorized access, and supply-chain vulnerabilities within the delivery pipeline.
6-month actionable security governance roadmap
Beyond issue detection, SiriusOne delivered a structured 3–6 month roadmap outlining priority fixes, process improvements, and DevSecOps controls. The roadmap aligned security initiatives with engineering capacity and business objectives, enabling continuous and measurable security maturity growth.
Similar
implemented cases: