Secure Development & Product Hardening for KumoCore & KumoPay
As part of its secure software development lifecycle (SSDLC), Vodworks continuously tests and hardens KumoCore and KumoPay through penetration testing, code review, and infrastructure assessments.
- Remediated and validated more than 40 security findings across applications, APIs, and cloud infrastructure.
- Embedded ongoing security testing into the software development lifecycle to support secure, resilient product releases.
About The Client
KumoCore is Vodworks' enterprise platform for creating, managing, and operating tokenized assets and digital marketplaces.
KumoPay is a supplier-agnostic on/off ramp platform for crypto and fiat payments that lets customers scale transactions, streamline payouts, and stay compliant worldwide.
As security is fundamental to both platforms, Vodworks embeds continuous security testing throughout the software development lifecycle to proactively identify, remediate, and validate security issues before they can impact customers.
The Scope
To maintain a robust security posture across its products, Vodworks performs regular security assessments of KumoCore and KumoPay as part of its secure development and product-hardening practices.
The objectives were to:
- Identify vulnerabilities across applications, APIs, infrastructure, and supporting services.
- Validate the effectiveness of authentication, authorisation, and security controls.
- Strengthen cloud, Kubernetes, and CI/CD security configurations.
- Ensure findings were prioritised, remediated, and independently retested before release.
Our Approach
Vodworks conducted comprehensive security assessments across both platforms using a combination of automated security tools and expert manual testing.
The assessments included:
Application & API Security
- Web application and API penetration testing
- Authentication and access-control testing
- Session and token security assessment
- Input validation and injection testing
Infrastructure & Platform Security
- Network scanning
- Source-code and dependency review
- Security configuration assessment
- Kubernetes and cloud security review
Validation & Remediation
- Risk-based prioritisation of findings
- Remediation guidance for engineering teams
- Independent verification and retesting of implemented fixes
- Continuous security improvements integrated into the software development lifecycle
Technologies & Forensic Tools
Vodworks combined automated security scanning with expert manual testing to provide comprehensive coverage across applications and infrastructure.
Tools and techniques included:
- Burp Suite
- OWASP ZAP
- Nmap
- SQLmap
- Kali Linux security utilities
The Results
The security assessments identified more than 40 security findings and improvement opportunities across KumoCore and KumoPay.
The assessments strengthened security across multiple areas, including:
- Authentication, authorisation, and token security
- API and microservice communication
- Cloud infrastructure and Kubernetes security
- CI/CD pipelines and software supply chain security
- Database security and access controls
- Dependency and third-party library management
- Application security headers and browser protections
- Input validation and secure file handling
All findings were remediated, validated, and independently retested as part of Vodworks’ secure development process.
The Outcome
Enhanced Product Security
- Vodworks remediated and validated more than 40 security findings, strengthening the security of KumoCore and KumoPay across applications, APIs, cloud infrastructure, and supporting services.
Continuous Security Assurance
- Embedded ongoing security testing and remediation into the software development lifecycle, supporting secure releases and improving resilience against evolving cyber threats.
Frequently Asked Questions
Is on-demand developer availability among your offerings in software development?
We provide you with on-demand engineers whether you need additional resources for ongoing projects or specific expertise, without the overhead or complication of traditional hiring processes within our staff augmentation service.
Are we able to vet the developers before we take them on-board?
When augmenting your team with our developers, you have the ability to meticulously vet candidates before onboarding. We ask clients to provide us with a required developer’s profile with needed skills and tech knowledge to guarantee our staff possess the expertise needed to contribute effectively to your software development projects. You have the flexibility to conduct interviews, and assess both developers’ soft skills and hard skills, ensuring a seamless alignment with your project requirements.
How do you manage and accommodate change requests in software development?
We seamlessly handle and accommodate change requests in our software development process through our adoption of the Agile methodology. We use flexible approaches that best align with each unique project and the client's working style. With a commitment to adaptability, our dedicated team is structured to be highly flexible, ensuring that change requests are efficiently managed, integrated, and implemented without compromising the quality of deliverables.
Who owns the IP of my application code/will I own the source code?
As our client, you retain full ownership of the source code, ensuring that you have the autonomy and control over your intellectual property throughout and beyond the development process.
How do you handle different time zones?
With a team of 150+ expert developers situated across 5 Global Development Centers and 10+ countries, we seamlessly navigate diverse timezones. This gives us the flexibility to support clients efficiently, aligning with their unique schedules and preferred work styles. No matter the timezone, we ensure that our services meet the specific needs and expectations of the project, fostering a collaborative and responsive partnership.
Get in Touch with us
Thank You!
Thank you for contacting us, we will get back to you as soon as possible.
Our Next Steps
- Our team reaches out to you within one business day
- We begin with an initial conversation to understand your needs
- Our analysts and developers evaluate the scope and propose a path forward
- We initiate the project, working towards successful software delivery