NoshRun
NoshRun
NoshRun is an Austin food-delivery startup running a full multi-service stack: a marketing site, a customer ordering app, a restaurant partner dashboard, a driver portal, an API, a promotions engine, and an internal operations panel. Seven flags, one engagement — start as an anonymous customer and end with the keys to the whole platform.
The Engagement
NoshRun's investors want a clean external pentest before the next round. You're handed the public surface and a single customer account — nothing else. Work the ordering app, the partner dashboard, the API, the promotions engine, and the internal ops panel, and see how far a startup that "shipped fast and locked it down later" really lets you get.
Background
NoshRun launched in 2022 — two UT Austin grads who were sick of the big delivery apps charging restaurants 30% and decided to do it for 15%. It worked: hundreds of local restaurants, thousands of customers, a fleet of drivers, a seed round. What didn't keep up was the security. Features shipped on Friday nights. Old API versions were "deprecated" but never actually turned off. Internal tools got left reachable because locking them down was always next sprint's problem. None of these bugs are exotic — they're the ordinary, devastating kind that a four-person engineering team accumulates when every week is a sprint to the next milestone. The impact isn't a debug banner; it's real people's home addresses, drivers' SSNs, restaurants' bank accounts, and — in the end — the run of their own servers.
WebRanges are included in Pro+. Get the full platform for $19.99/mo.
Get Pro+Open in dashboardTechniques