This is a public-safe write-up. Risk categories and business impact are described, but the specific mechanisms, locations, and reproduction steps behind each finding are deliberately withheld and shared only with the ScanTrader team.
ScanTrader, an AI stock chart analysis platform, commissioned an authorized external security assessment of its application and supporting systems. The review confirmed that a number of controls were already effective, documented a short set of prioritized findings rated by business impact, and delivered a remediation plan with defined closure criteria and a verification retest. Specific findings are not published: this write-up describes the engagement and its outcome, not the technical detail behind it.
ScanTrader is a trading analysis platform that brings together user accounts, chart analysis, trading content, subscriptions, and payments.
Because the product relies on several connected services, the ScanTrader team wanted to understand what an outsider could reach across the full platform, not only what was visible on the main website. Unbreachable conducted an authorized external assessment of the application and its supporting systems.
What we found
The assessment began by confirming what already worked, and a meaningful number of controls did. Several of the protections that matter most for a product handling accounts and subscriptions behaved exactly as the team intended, which meant the review could focus narrowly rather than rebuilding confidence from scratch.
A small set of findings was documented and ranked. Each was rated by realistic business consequence — the effect it could have on customer privacy, on revenue integrity, on platform trust, or on operating cost — rather than by a generic technical score.
The findings were the ordinary result of a product growing across several connected services at speed. None concerned the accuracy of ScanTrader's trading analysis, and none had been exploited.
This write-up deliberately stops here. The categories, locations, and mechanics behind each finding stay in the private report, because a published case study should demonstrate the value of an assessment without narrowing the search for anyone else. What is public is the shape of the engagement and the outcome; what is withheld is anything that would shorten an attacker's work.
There was no evidence in the assessment that ScanTrader had suffered a confirmed breach. The value of the engagement was timing: the team had a documented, prioritized picture of its own risk before any of it could become an incident.
What we recommended
Unbreachable delivered a remediation plan built around business impact rather than technical severity, so engineering time went where it protected customers first. The plan was structured rather than a flat list:
- Findings ordered by realistic business consequence, so the highest-impact work is unambiguous.
- A clear owner and a concrete engineering action defined for every item.
- Explicit closure criteria — what must be true before an item counts as resolved.
- Routine hygiene alongside the fixes: credential rotation, monitoring, and alerting on unusual activity.
- Request limits on the operations that are most expensive to serve.
- A verification retest of the full user journey once changes are deployed.
The report was equally explicit about what was NOT a vulnerability. Several implementation details that a scanner or a nervous reader might flag were documented as normal and safe, rather than being inflated into findings. Keeping that distinction sharp is what let a small team act on a short list with confidence instead of triaging noise.
The outcome
ScanTrader received a clear view of where its security already held up and a short, ordered list of what to strengthen first.
The team left the assessment with a direct order of operations and defined closure criteria, so progress could be measured rather than estimated, and a verification retest to confirm the original impact was genuinely gone.
By reviewing the product as one connected system rather than auditing each service in isolation, the assessment surfaced risk that a per-service review would have been likely to miss.
Security considerations for trading and financial analysis platforms
General context for this category of product. It is not a description of ScanTrader's assessment findings.
Trading and investment analysis tools carry a heavier security burden than most SaaS products of the same size. They combine user accounts, financial context, subscription billing, uploaded or generated content, and market data — often across several managed services that each have their own permission model. The application code can be sound while the seams between those services are where risk accumulates.
The most common pattern in this category is not an exotic exploit. It is an access boundary that holds in the main user journey but is applied less consistently in a secondary path — a background job, an admin workflow, a storage bucket, or a billing callback. Each service is individually configured correctly; the gap appears in how they trust one another.
Billing adds a second dimension. When subscription state can be influenced by anything other than a verified notification from the payment provider, the result is rarely direct theft — it is billing records that don't reconcile, trials that can be re-taken, and support tickets that are expensive to unpick. Treating the payment provider as the single source of truth for entitlement removes most of that class of problem at once.
For teams building in this space, the practical lesson is to review the product as one connected system rather than auditing each service separately. An external assessment is valuable precisely because it ignores the internal architecture diagram and asks only what an unauthenticated outsider can actually reach.
Why this matters for other SaaS teams
Products that connect an application, a database, object storage, an authentication provider, and a payment processor are secured at the boundaries, not inside any one service. Reviewing them together is what surfaces the risks that a per-service audit misses.
For teams in trading, fintech, or any subscription product handling money and user-generated content, the value of an early assessment is sequencing: knowing which boundary to reinforce first, and being able to prove to partners and larger customers that the question has been asked and answered.
Frequently asked questions
Does a published security case study reveal how to exploit the product?
No. Unbreachable publishes risk categories and business impact only. Mechanisms, affected locations, parameters, and reproduction steps stay in the private report shared with the client. A public case study should demonstrate the value of the assessment without becoming a guide for anyone else.
What does an external security assessment of a trading platform cover?
Typically the public application and its related hosts, authentication and account flows, how stored records are isolated between users, file and object storage permissions, subscription and billing journeys, abuse resistance on expensive operations, and the security headers and error detail exposed to the browser.
Do security findings mean a product is unsafe to use?
Not on their own. Every actively developed product accumulates boundary gaps as it adds services and features. What matters is whether a team finds them deliberately, understands the business impact, and fixes them in priority order — which is the difference between routine security work and an incident.
Why is billing a common source of security findings in SaaS products?
Because entitlement is decided in one place and consumed in another. If subscription status can be set or influenced by client-side input or by an unauthenticated request, rather than exclusively by a signed notification from the payment provider, the billing record and the access it grants can drift apart.
How is a security assessment different from an automated vulnerability scan?
An automated scan reports what it can pattern-match. An assessment adds manual validation: confirming whether a signal is genuinely exploitable, judging its real business impact, discarding false positives, and identifying logic and authorization gaps that no scanner recognizes because they require understanding what the product is supposed to do.
“Unbreachable showed us where the real risk was across the product instead of giving us a list of generic warnings. The report separated what was already secure from what needed immediate work and gave our team a clear remediation plan.”
— Hunter, ScanTrader