01 / Overview
Assessment overview
Riftweld conducted a security assessment of the Smileytics platform, focusing on the security of its web application, APIs, authentication and authorization mechanisms, patient-facing functionality, and controls protecting sensitive information.
02 / Scope
Areas assessed
Web application security
Security testing across the patient and clinic-facing web application, including workflows and input handling.
AssessedAPI security
Authentication, authorisation, object-level access, rate controls and data exposure across public and partner APIs.
AssessedAuthentication and authorization
Login, MFA, session lifecycle, account recovery and multi-tenant access-control boundaries.
AssessedPatient data and workflows
Sensitive-data exposure, file upload, input validation and controls around patient-facing workflows.
Assessed03 / Approach
Assessment approach
The assessment covered key areas including:
- Web application security testing
- API security testing
- Authentication and authorization mechanisms
- Multi-tenant access controls
- Sensitive-data exposure risks
- Session and account-management security
- File upload and input-validation controls
- Patient-facing workflows
- Security configuration and HTTP security headers
- Risk-based identification and documentation of security weaknesses
04 / Outcome
Assessment outcome
The assessment was designed to identify security risks that could affect the confidentiality, integrity and availability of the platform and the sensitive information it processes.
Riftweld provided security findings and actionable remediation recommendations to help Smileytics strengthen its security posture and improve confidence in the security of its platform.
05 / Engagement record
Engagement record
- Status
- Security assessment completed
- Engagement
- Smileytics × Riftweld
- Assessment type
- Web Application & API Security Assessment
- Method
- OWASP WSTG · ASVS 5.0 · API Top 10 · NIST SP 800-115
Security assessment overview. Assessment completed. Findings and evidence are documented in the full assessment report.