Hardening a Multi-Tenant Deployment Platform for Production Trust

Overview

This is a security-first engineering program behind a hosted platform that lets teams ship applications straight from source, on infrastructure the company owns, with the polished developer experience of a modern deploy tool and the isolation guarantees of a serious multi-tenant system. The client name, product, infrastructure specifics, and individual findings are withheld under NDA; the approach is generalised for publication.

The Challenge

A platform that runs other people's code and holds their secrets carries a heavy burden of trust. Every customer shares the same control plane, yet each must be cryptographically and operationally sealed off from every other. The goal was a premium, push-to-deploy developer experience, custom domains, automatic TLS, live build and runtime visibility, built on infrastructure the company runs itself rather than reselling a third party. That combination raises the security bar: tenant isolation, secrets handling, and the boundaries between tiers all have to hold under real adversarial pressure, not just pass a happy-path demo.

Our Approach

We treat security as a structural property, not a phase at the end. A small set of non-negotiable rules governs every file, so the safe path is also the default path.

• Tenant isolation. Every request is scoped to its organisation at the data layer; cross-tenant access is designed out, then verified.
• Encrypted secrets. Customer secrets are encrypted at rest with authenticated encryption and per-tenant key derivation, decrypted only at the moment of use.
• Adapter isolation. Every external dependency sits behind its own interface, keeping third-party surface area contained and swappable.
• Defense in depth. Mutual TLS between tiers, signature-verified webhooks, and layered rate limiting, so no single control is the only line.
• Validated config. Configuration is schema-checked at boot; a missing or malformed secret stops startup loudly rather than failing open.
• Audited and tested. Every customer-touching change is audit-logged, and behaviour is locked in with a broad automated test suite.

The Security Review

The platform was audited against the full OWASP Top 10, the industry reference for the classes of weakness that matter most in modern web systems. Each category was examined against the running code, findings were triaged by severity and real-world exploitability, and fixes shipped with regression tests so the same class of issue cannot quietly return. The review confirmed a genuinely mature foundation, strong cryptography, disciplined input handling, and consistent tenant scoping, while surfacing a focused set of hardening opportunities that were prioritised and remediated. Specific findings are held in confidence.

Outcomes

• Highest-impact risks closed first. Fixes were sequenced by real exploitability and blast radius, so effort went where it reduced risk most.
• Fixes that cannot regress. Each remediation shipped with regression tests and, where relevant, a boot-time guardrail, turning a one-time fix into a permanent invariant.
• Reusable safety primitives. Point fixes were generalised into shared, tested building blocks, so the whole codebase inherits the protection, not just one call site.

At a Glance

Security architecture · OWASP Top 10 review · Tenant isolation · Encrypted secrets · Defense in depth · Regression-tested remediation.