Audit & containment · Wealth management
Wealth management platform
A regulated wealth management firm built its internal platform with a team of non-developers and Claude Code agents. They use it every day for client onboarding files, CRM, advisor billing, AUM tracking and the order desk. It runs on Supabase and Netlify. I audited it, then worked inside their team to close the most urgent issues.
148
findings, 2 of them critical2 weeks
of containment, with their team- I spent three weeks on security, compliance and architecture, and came back with 148 findings (2 critical, 21 high) and 59 things worth keeping.
- A second AI model challenged every finding, and I checked each objection against the code. With an agent running on an open-weights model, I reproduced the riskiest authorization and security findings in an isolated local environment with synthetic data.
- Before any AI read the repository, I redacted it with patterns for IDs, tax numbers, bank accounts and emails, a secrets scanner, and a NER model running offline for people's names.
- In two weeks of containment, their team and I enforced two-factor authentication in the API and in the database, stopped agents from publishing to sensitive paths without review, replaced broad personal tokens with a scoped GitHub App, and rotated credentials.
- I wrote architecture decision records and per-area review criteria that the AI reviewer now reads before anything is published. I added tests that fail when a change breaks an architectural rule, and a data model diagram generated from the migrations. The rest went into a roadmap of 40 initiatives, each with a testable exit criterion.
