Telco Use Case — When a Billing API Leaks Subscribers
Challenge: Telco billing API allowed IDOR — change accountId, see another subscriber’s plan, balance, and PII. 12k accounts in one query. No WAF rule caught it — it was logic, not injection.
Solution — Snipeyes API + OSS/BSS Pen-Test:
- Manual BOLA/IDOR, authz bypass — not scanner
- Mapped to OWASP API Top 10 + GDPR — with PoC and fix (scoped authz check)
- Report: 1-page risk for C-suite (“12k at risk, 3-day fix”) + technical for devs
Outcome:
- Fix shipped in 3 days, retest closed — no customer notice needed
- WAF + API gateway rule added, now tested per sprint via Auto PenTest
- Audit evidence for ISO 27001 and GDPR Art.33 — no regulator call
Why it mattered: Scanners said “informational.” We showed the data.