A real estate marketplace preparing for a Series B had an exposed admin surface, a partner API without rate limits, and a session model that leaked tenancy under certain concurrency conditions. The investor security review was eight weeks out.
Over six weeks, we threat-modeled the three surfaces, patched the tenancy leak, added rate limits plus authenticated signatures to the partner API, hardened the admin surface against the OWASP top-10, and ran a red-team drill against the production environment with a signed scope.
The red team blocked every top-10 attempt, the diligence report came back with zero critical findings, and the funding round closed on schedule. The hardening approach is now the baseline for every new partner integration.