Overview
As Source2Sea’s cloud-native marketplace grew beyond MVP, security became business-critical. emagine delivered two structured penetration testing engagements to identify vulnerabilities, validate remediation and strengthen confidence across web, API and cloud layers.
The Challenge
Source2Sea operates a cloud-native marketplace platform serving buyers and suppliers in the maritime supply chain. As the platform evolved beyond MVP and increased in complexity, security became a more immediate priority. More users, more workflows and more architectural components meant greater exposure across the application, APIs and cloud environment.
An initial security assessment had already been completed during early development, but Source2Sea now needed a deeper and more structured review. The business wanted a clearer picture of risk across the platform and stronger assurance that key controls were working properly in practice. This included testing how well the platform handled different user roles and journeys, how securely APIs behaved in both authenticated and unauthenticated scenarios, and whether cloud-native components were appropriately protected.
Authentication and authorisation were especially important. The platform relied on OAuth2-based flows and supported multiple user experiences across buyer, supplier and shopping journeys. That created a need to validate that access controls were robust, permissions were correctly enforced and integrations were not introducing unnecessary exposure.
There was also a practical delivery challenge. Security work needed to reduce risk without slowing product development. Source2Sea did not need a theoretical review or an over-engineered process. It needed focused testing, clear prioritisation and actionable guidance that the technical team could work from. The business also wanted to confirm that once issues were addressed, remediation had genuinely reduced the underlying risk.
That made the challenge broader than a one-off pentest. Source2Sea needed a testing approach that could support a growing product over time — one that improved visibility across web, API and cloud layers, helped prioritise vulnerabilities based on real business risk, and created a more repeatable way to strengthen security maturity as the platform continued to scale.
- Beyond MVP
Security requirements increased as the platform moved beyond its MVP stage and grew in complexity. - Two user-facing environments
Testing needed to account for buyer and supplier experiences, alongside shopping journeys. - Multiple security layers
The review covered web applications, APIs and underlying cloud infrastructure. - Two priorities at once
Source2Sea needed to reduce security risk without slowing ongoing product development.
The Solution
emagine delivered two structured penetration testing engagements one year apart, using a repeatable methodology designed to assess risk, support remediation and strengthen long-term security maturity. The work covered the platform’s most important security layers — from user-facing web applications to APIs, authentication flows and cloud-native infrastructure.
Rather than treating security testing as a standalone exercise, emagine worked closely with Source2Sea’s technical team throughout. Critical findings were escalated early, remediation guidance was clear and practical, and retesting was used to confirm whether actions taken had properly addressed the issues identified.
Phase 1: Define scope around real platform risk
The first phase focused on defining a scope that reflected how the platform worked in practice. emagine assessed web application security across buyer, supplier and shopping experiences, ensuring the review matched the real user journeys that mattered to the business.
API testing was also included across both authenticated and unauthenticated scenarios. This helped build a fuller view of how different access points behaved and where weaknesses might affect security, functionality or trust. By focusing on real usage patterns rather than isolated components, the assessment could prioritise findings in a more practical and commercially relevant way.
Phase 2: Test critical controls across application and cloud layers
The second phase focused on the controls most central to platform security. emagine assessed OAuth2-based authentication and authorisation flows to verify that access was being managed securely across different user roles and interactions.
Alongside this, the team reviewed the cloud-native architecture hosted on Azure Kubernetes Service and tested both modular monolith and microservice components. This extended the assessment beyond the interface layer and into the underlying environment supporting the platform. The result was a broader view of exposure across the application stack, rather than a narrow review limited to front-end interactions.
Phase 3: Escalate findings early and guide remediation
Throughout the engagement, emagine worked closely with Source2Sea’s technical team to ensure findings could be acted on quickly. Critical issues were escalated early, allowing the client to respond without waiting for a final report.
Importantly, remediation guidance was delivered in a way that technical teams could use. The goal was not to overwhelm stakeholders with detail, but to provide clear direction on what needed fixing, why it mattered and how risk could be reduced in practice. This helped keep the work focused on improvement rather than analysis alone.
Phase 4: Retest and create a repeatable security approach
The final phase centred on validation. emagine retested identified vulnerabilities to confirm whether remediation actions had been effective. This gave Source2Sea stronger assurance that issues had not only been found, but properly addressed.
Delivered across two engagements one year apart, the work also helped establish a more repeatable approach to security testing. Instead of a one-off snapshot, Source2Sea gained a structure for assessing risk as the platform evolved — supporting future growth with stronger visibility, clearer prioritisation and more confidence in the security posture of the platform over time.
That knowledge transfer mattered as much as the initial delivery. It reduced dependency, protected continuity and helped Aris Global retain both product knowledge and improved ways of working internally.
Transformation timeline
Phase 1
Define scope around real platform risk
Phase 2
Test critical controls across application and cloud layers
Phase 3
Escalate findings early and guide remediation
Phase 4
Retest and create a repeatable security approach
The Results
The engagement improved visibility into platform risk and gave Source2Sea a stronger, more repeatable approach to security as the product grew.
Clearer visibility across the full platform
Source2Sea gained improved visibility into its security posture across web applications, APIs and cloud infrastructure. This created a more joined-up view of risk across the platform, rather than isolated technical checks.
Risk prioritised by business impact
The engagement helped identify and prioritise vulnerabilities based on real business risk. That made it easier for Source2Sea to focus effort where it would have the greatest impact.
Remediation validated, not assumed
Retesting confirmed that remediation actions had effectively addressed identified issues. This gave the technical team stronger assurance that fixes were reducing risk in practice.
A stronger foundation for future growth
The work increased confidence in authentication, authorisation and integration security, while establishing a repeatable testing approach to support platform growth over time.