AFINE

BACKGROUND

Introduce your business and what you do there.

I’m an SRE at Newrails UAB, a financial services company. We provide payment solutions powered by stablecoins, enabling fast, secure, and low-cost digital transactions.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with AFINE?

To comply with DORA regulations, we wanted to ensure our platform was solid from a security point of view.

SOLUTION

What was the scope of their involvement?

AFINE provided a web application security assessment. The platform separates verified business users (KYB-completed) from non-verified users. KYB itself runs through the Ssub SDK and is out of scope as a third-party managed flow. AFINE tested that non-KYB users couldn’t bypass the gate, access deposit endpoints, initiate outbound transfers, retrieve KYB-only data, or reach any feature reserved for verified users. Bypass attempts covered horizontal and vertical privilege escalation across the API surface, IDOR on user and account objects, parameter tampering on KYB-state checks, and forced browsing to KYB-only routes. AFINE also confirmed that KYB documents and Ssub session tokens couldn’t be retrieved by an authenticated non-KYB user via authorization bypass.The team also examined the money movement flows. They tested the Verification of Payee (VOP) control on outbound transfers to see if it could be bypassed, spoofed, or replayed; if VOP responses could be tampered with on the client side and accepted server-side; and if downgrade attacks against VOP were possible. AFINE tested fund movement integrity end-to-end, including balance reads versus debit/credit operations, transaction state machine transitions, idempotency of transfer endpoints, and resilience of transfer authorization to replay, parameter tampering, and step-skipping. SEPA and SWIFT message payloads were examined for injection or tampering vectors at the API boundary.AFINE also tested monetary value handling. They examined rounding behavior at the API boundary and across currency conversion (multi-currency wallets in 20+ currencies create rounding edge cases that can be abused), decimal precision handling, integer overflow on amount fields, negative-amount and zero-amount edge cases, and currency mismatch attacks where a request specifies one currency on the client and another on the server. IDOR was tested on transaction objects, account references, and pending-transfer objects so a low-privilege account couldn’t read or modify another user’s transactions. Floor/ceiling abuse on conversion rates was also examined.The team also conducted concurrency-focused testing of the balance and transfer flows. They attempted double-spend by issuing parallel withdrawal or transfer requests against the same account balance, race conditions on transfer state transitions (concurrent confirm/cancel), TOCTOU on balance checks, idempotency-key collisions and bypass, and concurrent KYB-state transitions.Finally, AFINE examined the authentication surface. They examined the registration flow, the passcode set/reset flow, SMS OTP delivery and validation, session token issuance and lifecycle, JWT handling, password recovery, and step-up authentication for sensitive actions. Brute-force and credential stuffing tests were designed to respect the production lockout policy so test traffic didn’t lock out real customer accounts. Authentication bypass attempts covered JWT signature validation, session fixation, parallel session abuse, and OTP-step skipping via parameter tampering.

What is the team composition?

We worked with 2–5 teammates from AFINE.

How did you come to work with AFINE?

We found them through an online search. We chose them because they were close to our geographic location, they offered good value for the cost, and their company values aligned with ours.

What is the status of this engagement?

We worked together from May–June 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

AFINE helped us patch 10 vulnerabilities.

How did AFINE perform from a project management standpoint?

AFINE’s project management was very dedicated. They were pushy for movement and transparent. We communicated via email and messaging apps.

What did you find most impressive about them?

AFINE’s professionalism, knowledge, and speed were impressive.

Are there any areas they could improve?

No, everything was good.

BACKGROUND

Please describe your company and position.

I am the Head Of IT of Kingmakers

Describe what your company does in a single sentence.

Igaming Services

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire AFINE to accomplish?

• Penetration Testing Projects
• Regulatory Compliance

SOLUTION

How did you find AFINE?

• Referral
• Other

Why did you select AFINE over others?

• High ratings
• Pricing fit our budget
• Great culture fit
• Company values aligned
• Other

How many teammates from AFINE were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

• Penetration Testing on our gaming eco-system
• Vulnerability Management across technologies and buisness logic
• Regulatory Compliance reporting
• Cybersecurity posture

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

• Number of Critical Issues Found:  Critical issues were detected, including SQL injection vulnerabilities, cross-site scripting (XSS), and privilege escalation opportunities.
• Tested: 100% of the critical applications in production were subjected to thorough testing.
• Detailed Reports Generated: Comprehensive reports detailing all findings, remediation actions, and recommended improvements were provided to stakeholders, ensuring transparency and accountability.
• Risk Assessment Updated: The organization's risk assessment documentation was updated based on the pentest findings, leading to a more accurate understanding of current security risks.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

• Fast communication via slack and email
• Quick and easy project management timeline that fit our deadlines.
• Helpful staff that deliver the project on time and even before the actual deadline
• Amazing service overall

What was your primary form of communication with AFINE?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

• The amount of knowledge by the AFINE Team
• The dedication and attention to detail on the project requirements and results
• Very fast and helpful staff members especially Arthur, friendly pentesters who worked on the projects

Are there any areas for improvement or something AFINE could have done differently?

No major improvements. We were very happy with the services provided

BACKGROUND

Please describe your company and position.

I am the CEO of an AI software company

Describe what your company does in a single sentence.

AI-powered app: our AI agent quantifies team collaboration data to assist teams with smart hacks and micro automations aimed at optimizing performance climb.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire AFINE to accomplish?

Penetration tests

SOLUTION

How did you find AFINE?

Referral

Why did you select AFINE over others?

High ratings

How many teammates from AFINE were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

penetration tests + report + re-tests

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Tests + report + retests + report

Describe their project management. Did they deliver items on time? How did they respond to your needs?

The project management skills demonstrated by Afine during our penetration testing engagement were nothing short of exemplary. We've been working with Afine for 3 years, and this experience has only reinforced our decision to continue our partnership for many years ahead.

From the onset, they established clear timelines and milestones, ensuring a transparent and effective communication process throughout. Their team not only delivered all items on or ahead of schedule but also adapted swiftly to any changes or additional requirements we introduced. This level of flexibility and efficiency significantly contributed to the smooth progression and success of the project. 

Afine exceeded our expectations in every aspect of project management. Their dedication to meeting deadlines and their unwavering support in responding to our needs made them a valuable partner in our cybersecurity efforts. I would highly recommend their services to any organization looking to strengthen their security posture through professional and thorough penetration testing.

What was your primary form of communication with AFINE?

Email or Messaging App

What did you find most impressive or unique about this company?

What stood out most was the responsiveness to our needs. They were always available to address our queries and concerns, providing detailed explanations and timely updates that kept us informed every step of the way. Their proactive approach to anticipating potential issues and offering solutions before they could impact the project timeline was particularly impressive.

Are there any areas for improvement or something AFINE could have done differently?

None

BACKGROUND

Please describe your company and position.

I am the Director of a cybersecurity company.

Describe what your company does in a single sentence.

Penetration testers specializing in web apps, APIs, portals, e-commerce, and mobile apps.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire AFINE to accomplish?

Assistance with overage capacity

SOLUTION

How did you find AFINE?

Existing personal relationship

Why did you select AFINE over others?

• High ratings
• Great culture fit
• Company values aligned
• Quality of expertise

How many teammates from AFINE were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Provision of additional specialist web app, API, and mobile app penetration testing capacity to supplement our own.

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

Meeting our own high standards in terms of technical expertise and experience

Describe their project management. Did they deliver items on time? How did they respond to your needs?

Strong, clear, and timely communications within our own applications and toolsets, at and above requirements and expectations.

What was your primary form of communication with AFINE?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

Their technical competence and experience, combined with good communication and professional approach, are impressive.

Are there any areas for improvement or something AFINE could have done differently?

None