Penetration Testing a Ride-Hailing Solution
The Challenge
The platform moved millions of trips a month through two mobile apps and a cloud back end that held live location data, payment methods, and driver identity documents.
Leadership needed to know whether a rider could track a driver, whether a driver could manipulate fares, and whether the cloud estate exposed any of that data.
“Location privacy was our biggest fear. They found the two ways it could leak, showed us the fix, and confirmed it closed. That is exactly what we needed.”
The Execution
Scope
We agreed on the rider and driver apps, dispatch, pricing, and payment APIs, and the cloud accounts behind them, with test fleets in a staging city.
Test
Mobile reverse engineering and API testing revealed excessive location exposure in trip endpoints and a fare-adjustment flow that trusted client-side values.
Review
The cloud review found over-privileged service roles and public storage containing driver documents from an old migration.
Retest
Fixes for location exposure, fare integrity, and cloud permissions were verified, and the app release was cleared for the stores.
The Outcome
Riders and drivers can no longer be tracked beyond an active trip, fares are enforced server-side, and the exposed documents were removed and access locked down.
The platform added NodeRisk mobile testing to its release cycle and uses the findings as training material for its engineers.