How Code House Strengthened Platform Security with ZeroThreat’s Automated Web & API Pentesting

Code House builds and maintains a business-critical accounting and payroll software platform used to manage sensitive financial and employee data.

The platform is continuously enhanced through regular updates, with security validation performed in a structured staging (UAT) environment before production releases. Given the nature of the product, security and reliability are treated as ongoing responsibilities rather than one-time checks.

Code House already had penetration testing in place as part of its security program. However, relying primarily on periodic penetration tests created challenges:

• Limited visibility into security risks earlier in the release cycle
• Findings often surfaced late, leaving limited time for remediation
• Manual effort required to validate fixes after changes
• Gaps between penetration tests where issues could remain undetected

The team needed a way to complement penetration testing with earlier, repeatable security validation—without adding operational overhead.

1. Automated web and API pentesting across the platform
2. Earlier identification of exploitable application and API risks
3. Faster validation of fixes through repeatable scans
4. Complements existing penetration testing with earlier coverage

Before ZeroThreat	After ZeroThreat
Reliance on periodic penetration testing	Security validated during UAT
Limited early visibility before release	Earlier visibility into application and API risks
Manual validation of fixes	Fix impact confirmed through re-scans
Late discovery of some issues	Fewer critical surprises during penetration testing

When scans are run

• Security scans are executed in the staging (UAT) environment
• Scans are aligned with release readiness, not a fixed schedule
• Additional scans are run when significant changes are introduced

How findings are handled

• Vulnerabilities are reviewed and prioritized based on severity
• Critical and high-severity issues are addressed immediately
• Lower-severity or complex issues are planned into upcoming updates
• Critical vulnerabilities are fixed promptly and included in live updates when required

In recent release scans, ZeroThreat identified security risks across both the web application and supporting APIs, including:

• Input validation and state handling weaknesses
• Client-side security risks across complex user workflows
• Insecure handling of sensitive data in browser storage
• Session and cookie configuration gaps impacting security controls
• Error handling behaviors that could expose unintended information

These issues are difficult to identify consistently through periodic testing alone and benefit from repeatable, automated validation earlier in the release cycle.

What Mattered Most

Several of these risks were identified earlier in the development lifecycle, allowing the team to remediate them and validate fixes before production, improving overall platform security without disrupting release timelines.

After integrating ZeroThreat, Code House observed measurable improvements in security readiness and operational efficiency.

Security & Release Outcomes

• Security risks identified earlier in the release cycle
• Faster validation of fixes before production
• Fewer critical findings during penetration testing

Workflow Improvements

• Reduced last-minute remediation pressure
• Clearer prioritization of security issues
• Improved coordination between development and security reviews

Team Confidence

• Greater confidence during release readiness checks
• Improved clarity on vulnerability severity and impact
• Penetration testing used for assurance rather than discovery