01 / Executive decision
The product works. Its trust boundary still behaves like a prototype.
The team has a viable product, sound core technology choices, and a working device lifecycle. Growth should continue only after shared access, device-control authorization, and production safety defaults are contained.
KeepThe core product and provisioning model
Contain nowShared access and exposed control paths
Fix nextDevice identity, delivery safety, and release evidence
02 / Critical workflow
Remote device control
01Mobile appsUser + setup
→02Backend APIAccounts + data
→03Control planeShared access
→04MessagingCommand delivery
→05Device fleetPhysical action
Primary gap: mobile clients, backend services, and devices share too much control-plane authority. A credential extracted from one layer can cross customer and device boundaries instead of being constrained to one identity and one action.
03 / Priority findings
Four findings change the plan.
F-01 / CriticalShared secrets escape every intended boundary
EvidenceLong-lived messaging, cloud, and release credentials were present across server and mobile code. Multiple components relied on the same shared identity.
ImpactA secret recovered from one application can be reused to impersonate trusted infrastructure or act on devices outside the current user scope.
InterventionRotate and revoke exposed credentials, move server secrets to managed storage, then issue per-device identities with narrowly scoped permissions.
Device-changing actions lack one reliable authorization gate
EvidenceSome command, reset, and device-update paths did not consistently require authenticated ownership checks. Mobile clients could also reach management capabilities directly.
ImpactAn untrusted caller can potentially change device state, while the team has no single server-side policy to prove who was allowed to do what.
InterventionRemove client access to the management plane and enforce identity, ownership, action policy, and audit recording at execution time.
Authentication and transport defaults weaken each other
EvidenceThe review found unsafe query construction, verification material exposed through an API response, permissive production settings, and disabled transport protections.
ImpactSeparate implementation shortcuts combine into practical account, data, and traffic compromise paths.
InterventionParameterize database access, keep verification codes out of responses, shorten session lifetimes, and enforce secure transport in every production client.
A working prototype is carrying production operations
EvidenceDevice messaging ran inside the web application, a broker migration duplicated paths, operational state lived on local disk, and critical flows had no meaningful automated test or delivery gate.
ImpactScaling the API multiplies message handling, failures are hard to reconstruct, and every release depends on manual knowledge.
InterventionSeparate device messaging from request handling, persist operational state, and add a thin CI and observability baseline before broad refactoring.
04 / What already works
Do not rewrite the product.
The stack is appropriate for the product. Device onboarding is coherent, the hardware boundary is sensible, remote update capability exists, and the ongoing cloud migration has the right destination. The recommendation is to preserve those assets while replacing the unsafe trust and operating model around them.
PreserveProduct behavior and device onboarding
StrengthenIdentity, command routing, and observability
AvoidA risky full-platform rewrite
05 / Recommended sequence
Eight weeks, in order.
- 0-72 hoursContain active exposure
Rotate shared credentials, revoke old access, close unauthenticated control paths, disable unsafe production defaults, and record the response.
- Week 1Restore the trust boundary
Move secrets out of source, enforce server-side ownership checks, repair authentication and query handling, and require secure transport.
- Weeks 2-3Make change safe
Add CI, secret scanning, critical-path tests, structured logs, release checks, and a repeatable deployment baseline.
- Weeks 4-8Separate device operations
Extract messaging from the web process, introduce per-device identity and scoped permissions, consolidate the broker path, and centralize device state.
06 / What the full report contains
Evidence your team can act on.
Deliverable 01Executive decision brief
AnswersWhat is safe to keep shipping, what must be contained, and which decisions cannot wait.
AudienceFounders, product leaders, and engineering owners.
UseAlign the next planning cycle around risk and customer impact.
System map and evidence register
AnswersWhere trust, data, commands, and operational ownership cross system boundaries.
EvidenceEach finding links observed behavior to impact, severity, and the smallest useful intervention.
UseTurn vague concern into reviewable engineering work.
Sequenced remediation plan
AnswersWhat to do in the first 72 hours, the first month, and the following structural phase.
ConstraintsDependencies, team capacity, migration risk, and work that should wait.
UseMove from audit findings to an executable 30-60 day plan.