Government VAPT: Entrepreneur Management Platform

How it helps your business

• The critical issues got found and fixed before an attacker could reach them: a SQL injection risk, broken access control exposing participant records, and a database open to the public internet.
• Each finding came with proof-of-concept evidence and step-by-step fixes, so the developers knew exactly what to change.
• The retest and clean closure report gave the team written proof the issues were actually resolved, not just acknowledged.
• Findings mapped to the PDPA principles and the Dasar Keselamatan ICT Kerajaan, so the report fed straight into compliance sign-off.

A full VAPT of a government platform, from critical findings to a verified clean closure report.

This government platform manages entrepreneur programme participants across multiple districts and roles, so it holds a lot of personal data. We ran a full security assessment of it: grey-box testing across the web app, APIs, database and infrastructure, against OWASP, the OWASP API Top 10 and PTES. The work surfaced 11 findings, each ranked by CVSS v3.1 with proof-of-concept evidence and step-by-step fixes. After the client's team remediated, we retested and issued a clean closure report. Every finding was mapped to the PDPA principles and the Dasar Keselamatan ICT Kerajaan, so it slotted straight into the project's compliance sign-off.