We Ran 5 Audits on Our Own SaaS in One Week. Found 62 Problems.

We ran 5 audits on our own SaaS in one week. Found 62 problems.

Nobody audits their own product for fun. We did it because our WhatsApp launch kept breaking in new and creative ways, and I got tired of finding out from users. So: five audits, one week, every layer — security, performance, money, UX, infrastructure. 62 findings. Here's the honest report.

The scoreboard

Fourteen critical issues sitting in production. On a product taking real payments. Let that sink in.

The worst finds (my personal shame list)

No database backups. None. One wrong docker volume rm away from losing every tenant's data. Fix took 20 minutes: a dump script plus a cron line. The scariest finding had the cheapest fix — that's usually how it goes. Quota limits nobody enforced. We had subscription plans with post limits — Starter 1,500, Pro 7,500 — and the code that counts usage was never called. Anyone could post unlimited on the cheapest plan. For months. New users landed on an empty page. After registration: an analytics dashboard with zero data and a lonely "No data" message. No onboarding, no checklist, no hint what to click. Our activation funnel had a hole you could drive a truck through. The frontend was stale for weeks. The backend moved API paths, Vercel builds were failing on a missing icon import, and production served the old bundle. Users got "Not Found" on the QR screen. Nobody noticed until a live test with a real user. Embarrassing? Deeply. Useful? Enormously — now every deploy gets verified against the live bundle. Real users saw [object Object]. A registration validation error rendered a raw JS object string to a user named Ksenia. Password rules existed only on the backend; the form never mentioned them. She tried five times. Five.

What actually surprised me

The audits that found the scariest stuff weren't the "clever" ones. No exotic vulnerabilities, no brilliant performance insights. It was the boring checklist stuff: backups, limits, error messages, onboarding. The unglamorous layer is where production systems actually die.

Also: fixing 31 critical + important issues took about two weeks, not two quarters. Most findings were small — a missing index here, a wrong message there. The cost wasn't in the fixes. It was in not looking.

What we changed permanently

1. Every deploy now ends with a live verification (health + routes + bundle check), not "push and pray."
2. Migrations run on container boot — and we learned the hard way that workers must pause during DDL, or locks hang forever.
3. Error messages get the same review as features. If a user can see it, it's UX.

The takeaway

Audit your own product before your users do it for you. Pick one layer this week — backups is my recommendation, it's always backups — and look. You'll find something. Everyone does.

When did you last audit your own stuff? What was the most embarrassing find?