Next.js Application Security Audit: Fixing 47 Vulnerabilities and Achieving SOC 2
Compliance

The Challenge

A fintech startup handling sensitive financial data — including bank account connections through Plaid, transaction histories, credit scores, and identity verification documents — was preparing for their first SOC 2 Type II audit. The company had built their customer-facing application on Next.js with a Node.js backend, and the engineering team was confident in their security posture.

The pre-audit assessment told a different story. A comprehensive penetration test revealed 47 distinct security vulnerabilities across the application stack, ranging from informational (3) to low (14), medium (22), and high (8). No critical vulnerabilities were found, but the sheer volume of medium and high findings made SOC 2 compliance impossible without a systematic remediation effort.

The vulnerabilities followed common patterns. The most concerning were Server-Side Request Forgery (SSRF) vulnerabilities in the document upload feature, where user-supplied URLs were fetched without proper validation — an attacker could potentially use this to probe internal services. Cross-Site Scripting (XSS) vulnerabilities existed in the admin dashboard where user-generated content (transaction descriptions, merchant names imported from external systems) was rendered without proper sanitization. Several API endpoints lacked proper rate limiting, making them susceptible to brute-force attacks on user authentication and the password reset flow.

Beyond the code-level vulnerabilities, the security posture was missing fundamental controls. There was no centralized authentication logging, no security headers on API responses, no Content Security Policy (CSP) configured, and the session management used a custom token implementation with known weaknesses. The database — hosted on a managed PostgreSQL instance — had public access enabled from any IP address, protected only by the database password.

The CISO (who had joined the company just 3 months prior) described the situation: "We built fast and we built well from a product perspective, but security was always the thing we'd 'get to later.' Later had arrived, and our SOC 2 auditor was not impressed. We had 90 days to remediate every finding before the audit window closed, or we'd lose six months of compliance timeline — and likely several enterprise deals that were contingent on SOC 2 certification."

Our Approach

SoniNow conducted a comprehensive security audit and remediation engagement spanning the full application stack, from the Next.js frontend through the API layer to the infrastructure and data stores.

Phase 1: Vulnerability Confirmation and Triage. The initial penetration test had identified 47 findings. Our first step was independently confirming each finding and classifying it by severity, exploitability, and remediation complexity. We created a remediation roadmap organized into three waves: Wave 1 (weeks 1-3) addressed the 8 high-severity findings and 10 medium-severity findings with straightforward fixes. Wave 2 (weeks 4-6) tackled the remaining medium-severity findings that required architectural changes. Wave 3 (weeks 7-10) addressed low-severity findings, hardening, and documentation required for SOC 2 evidence.

Phase 2: Code-Level Remediation. We worked directly with the engineering team to patch vulnerabilities in the Next.js application and Node.js API. Each fix was deployed through the existing CI/CD pipeline with automated security regression tests to prevent reintroduction.

Phase 3: Security Controls Implementation. Beyond code fixes, we implemented a comprehensive security controls framework that covered application security, infrastructure security, and operational security — the three pillars that SOC 2 auditors evaluate.

Phase 4: Evidence Collection and Audit Support. We prepared the SOC 2 evidence package, documenting every security control, its implementation date, monitoring procedures, and effectiveness verification. We supported the engineering team through two auditor evidence requests and one on-site audit day.

The Solution

The remediation was executed over 10 weeks with zero disruptions to the application's 99.9% uptime.

Frontend Security (Next.js). We implemented a strict Content Security Policy using Next.js's built-in middleware and custom headers. All user-generated content was sanitized through DOMPurify before rendering. We added HTTP security headers (Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) at the Vercel edge level. Authentication tokens were rotated from localStorage to httpOnly, secure, SameSite=Strict cookies, eliminating XSS-based token exfiltration vectors. Input validation was hardened across all forms using server-side Zod schemas that mirrored the TypeScript types.

API Security (Node.js/Express). The SSRF vulnerability in the document upload feature was fixed by implementing a URL validation allowlist — only URLs from trusted domains (specific S3 buckets, approved document processing partners) were permitted, with all others blocked at the application firewall layer. Rate limiting was implemented using an Express middleware with Redis-backed sliding window counters, configured per-endpoint with appropriate thresholds (login: 5 attempts per minute, password reset: 3 per hour, general API: 100 per minute per user). Input validation was centralized using Zod schemas with a custom middleware that stripped unexpected fields and rejected malformed input before it reached route handlers.

Infrastructure Security. The database was moved to a private subnet with VPC-only access, accessible only through the application server's security group. We implemented WAF rules on CloudFront that blocked requests with suspicious patterns (SQL injection attempts, path traversal, known bot IP ranges). AWS GuardDuty was enabled with automated response playbooks for critical findings. All infrastructure changes were codified in Terraform with automated security scanning (Checkov) in the CI/CD pipeline.

Authentication and Session Management. The custom session token implementation was replaced with standardized JWT access tokens (15-minute expiry) paired with httpOnly refresh tokens (7-day expiry, rotation on use). Multi-factor authentication was implemented using TOTP with recovery codes. All authentication events (login success, login failure, password change, MFA enrollment) were logged to a centralized SIEM (Datadog Logs) with 1-year retention.

Results

The engagement delivered both immediate security improvements and the compliance milestone the company needed:

• All 47 vulnerabilities remediated — 8 high, 22 medium, 14 low, and 3 informational findings closed within the audit window
• SOC 2 Type II certification achieved on schedule, with zero auditor-identified gaps
• Application security score (as measured by an independent third-party scanner) improved from 58/100 to 97/100
• Zero security incidents in the 12 months following remediation (down from 2 in the preceding 12 months)
• Enterprise deals unlocked — 4 contracts worth $2.1M in ARR were signed within 60 days of SOC 2 certification
• Auth-related support tickets decreased by 80% as the new authentication system eliminated session-related issues
• Security scan integrated into CI/CD — every deployment is now automatically scanned, with critical/high findings blocking the pipeline
• Engineering team security maturity level increased from ad-hoc to defined (Level 2 to Level 3 on the SSE CMM maturity model)

"SoniNow's security audit was thorough, honest, and action-oriented. They found things our internal team had missed, fixed them without breaking anything, and left us with security controls and documentation that sailed through SOC 2 audit. The enterprise revenue we've unlocked since certification has already paid for the engagement many times over."
— CISO, Fintech Startup

Ready for similar results?

If you're preparing for a SOC 2 audit, responding to a security incident, or simply want to understand your application's true security posture, SoniNow's security audit and remediation practice can help. Contact SoniNow for a confidential security assessment.