Online Ordering and Pickup Penetration Test for a Regional Grocery Chain
A flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
Client name withheld by agreement- Client
- Regional supermarket chain, 210 stores
- Region
- Edison, New Jersey
- Year
- 2025
- Duration
- 6 weeks
- Scope
- Web and mobile ordering · SNAP EBT checkout · associate picking app · 22 APIs
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A regional supermarket chain with 210 stores had rebuilt online ordering for delivery and curbside pickup, including online SNAP EBT payment, digital coupons and a handheld app that store associates use to pick orders and approve substitutions.
Thanksgiving pre-orders were six weeks away. The website had been tested, but the associate app, the coupon engine and the APIs connecting them had not, and coupon fraud was already showing up in the chain’s refund data.
What we did
The approach, step by step.
- 01
Abuse cases first
We mapped how someone profits from a grocery platform: other shoppers’ data, stacked or replayed coupons, gift card balances and substitutions approved on someone else’s account.
- 02
APIs tested by hand
Testers worked through 22 APIs behind the web and mobile apps and found that order identifiers were sequential and not bound to the signed-in shopper.
- 03
Associate app examined
The picking app kept a long-lived store token on shared handhelds, and that token could be reused from outside the store network to approve refunds.
- 04
Fixes verified in days
Critical findings went to the development partner the same day, and we retested each fix in staging within 48 hours.
Outcomes
What changed, in numbers.
- 2
- critical flaws fixed before peak
- 22
- APIs tested for authorization flaws
- 48 hrs
- from fix to verified retest
- 0
- coupon replay paths remaining
They found the problems our shoppers would never forgive us for, and they found them in time.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Albany, New York · 16 weeks
Offensive Security & Resilience · 2024Ransomware Resilience for a Gas and Electric Distribution UtilityIdentity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
-
Stamford, Connecticut · 28 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
-
Hartford, Connecticut · 13 weeks
Offensive Security & Resilience · 2024Cyber Continuity and Enterprise Risk for a Mutual Property InsurerClaims kept moving through a simulated ransomware attack during a hurricane surge, and cyber risk now reports to the board against a stated appetite.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.