Most teams write the feature, ship it, then hire someone to find the holes. That order is why the holes are expensive. We build the control and the feature in the same commit, and we write the test that proves an attacker’s path is closed before we write the one that proves the happy path works.
How we actually work
Default deny, scoped to the authenticated user. Every read and every write is filtered by who is asking. In Whinchat, deriving a valid conversation ID is explicitly not permission to use it — the server re-checks the connection between two people on every read, write, call and key lookup, so naming a room you technically computed correctly still returns 403. Insecure direct object reference is not a bug class we patch; it is a shape the data layer refuses to take.
Fail closed, always. A session token with no expiry is treated as expired
rather than as valid forever. With no APP_TOKEN configured, the Newsroom’s
spending and outbound endpoints refuse everything rather than falling open. When a
security dependency is unavailable, the answer is no.
The allowlist is source code. Newsroom and Kickoff both aggregate third-party
feeds — a textbook SSRF surface. The feed list lives in a reviewed source file, the
fetcher refuses any host not derived from it, refuses plain HTTP, and sets
redirect: 'error'. That last one matters more than it looks: an allowlisted host
that 302s to a cloud metadata endpoint walks straight out of the allowlist you
just checked, and following redirects is how that attack succeeds.
Rate limits that understand the threat. In Clepora Jobs, per-IP budgets count
every attempt — that is volume defence. The per-account login budget is spent only
by failures, so credential-guessing against one account locks out fast while a
real person logging in repeatedly never does. Over-limit requests get 429 plus
Retry-After. Same discipline on body size caps and upload limits.
Secrets never enter the repository. Env-driven configuration, .env.example
committed and .env never, gitleaks wired into the pipeline. Credentials for
outbound publishing live with the operator’s automation, not inside the app.
Regulatory screening where money moves. Whinchat screens against the OFAC SDN list with a refreshable dataset, gates by age, and requires verification of both sides before a transaction is possible.
What that produces
| Product | Security-relevant coverage |
|---|---|
| Whinchat | 1,078 Python test functions + 47 browser suites, incl. authz denial, age gate, admin password, sanctions |
| Clepora Jobs | 785 tests, incl. rate-limit budgets, session expiry, self-scoped /me/* endpoints |
| Newsroom | 715 tests, incl. a dedicated security.test.js, tenancy isolation, token/session, role ladder |
Frameworks
We build against OWASP ASVS and NIST SP 800-53 control families, and we write the evidence as we go rather than reconstructing it for an auditor later.
Pontelon has not yet completed a SOC 2 or FedRAMP audit, and we will not claim otherwise. What we will do is build your system so that when you go for one, the controls, the audit log and the test evidence are already there.
Engage us for
- Secure build — new service or product, controls in from commit one.
- Pre-audit hardening — a system that works, readied for SOC 2 / ISO 27001 / FedRAMP evidence.
- Security review — threat model, code review, and a prioritized fix list with regression tests attached.