Utility Brook
Client stories
Notes from teams who brought us into a release cycle. Specific constraints, specific outcomes — not star widgets.
Testimonials
They caught an authorization gap on our partner API that our internal checklist had marked “covered.” The write-up included the exact route, the privilege step, and a patch outline our lead merged the same week.
Mei-Ling Chen · Platform lead, fintech product team · Secure Code Review
The hardening advisory after the review was more useful than another scan. We finally had a sequenced plan for session cookies, CSRF on legacy forms, and dependency freezes before our Taipei launch.
Jonas Park · Engineering manager · Application Hardening Advisory
I asked for a pre-release assessment with only four days left. Utility Brook was clear about what they could and could not cover in that window. We postponed one partner feature and shipped the rest with eyes open — that honesty mattered more than a longer report.
Arun Desai · Head of product · Pre-Release Security Assessment
The threat walkthrough slowed us down for a day and saved weeks. Mapping trust boundaries before we wired the new identity provider exposed two places where service accounts would have held far too much power.
Hana Wu · Staff engineer · Architecture Threat Walkthrough
Extended story: Partner API before banking go-live
A Taipei product team integrating a banking partner needed confidence in authorization and token handling three weeks before certification testing. Utility Brook scoped a secure code review to the partner-facing API, admin tooling that could mint elevated tokens, and the session bridge between the consumer app and the API.
Findings included a broken object-level authorization path on a “read invoice” endpoint when called with a partner-scoped token, and refresh-token rotation that failed closed in one language client but not another. The team patched the authorization check first, added regression tests, and used a short hardening advisory week to align cookie flags across web and mobile webviews.
The banking certification proceeded on schedule. The team kept the findings format as their internal template for later reviews.
Extended story: Legacy admin console
A logistics company kept a long-lived admin console beside a newer customer portal. Automated scanners mostly ignored the admin app. A five-day review concentrated on role checks, CSRF on state-changing forms, and export endpoints that dumped customer lists.
Several medium findings were accepted as backlog. One high finding — an export route reachable by a support role that should have been analyst-only — was fixed before the next production deploy. The client noted that scheduling the review earlier would have been easier; release week still worked because scope stayed narrow.