Guide

10 Security Checks for Fintech Applications

A practical scope checklist for payment platforms, financial APIs and account workflows.

Use these questions to shape an authorised assessment. They describe security controls to review; they are not a ranking of prevalence or a promise that every application contains these vulnerabilities.

1. Object ownership

Does every operation enforce access to the requested account, transaction, document or export? Check the server-side permission boundary across roles and tenants.

2. Transaction integrity

Are balance changes and transaction records updated consistently? Review retries, concurrency and idempotency together.

3. Token validation

Are accepted algorithms and trusted keys selected by server configuration? Validate issuer, audience, expiry and revocation behaviour appropriate to the application.

4. Payment state transitions

Can a workflow skip approval, reuse an authorisation or reverse a settlement incorrectly? Document allowed transitions and enforce them server-side.

5. Outbound requests

Can user-controlled callback or import destinations reach unauthorised services? Review URL handling, redirects, DNS resolution and network egress together.

6. Identity-verification integration

Are decisions obtained from an authenticated source? Check signed callbacks, replay handling and the precise states that permit restricted actions.

7. Sensitive-operation limits

Are repeated recovery, verification and transaction attempts controlled across relevant accounts and sessions? Choose limits using the operation’s risk and legitimate usage.

8. GraphQL boundaries

Are permissions enforced in every relevant resolver? Review query complexity, batching and operation-level resource limits. Disabling introspection alone is not an access control.

9. Real-time authorisation

Can users subscribe only to their own authorised channels? Recheck permissions when sessions expire or account roles change.

10. Information exposure

Do logs, errors and responses reveal secrets or unnecessary customer data? Review production behaviour and access to diagnostic endpoints.

Turn the checklist into a scope

Choose the most important customer journeys, identify their roles and connected services, then agree test accounts and boundaries. A report should connect findings to those workflows and make limitations explicit.

See the payment-platform case and how we count our published findings.