Agencies, retail and commercial operations

Most organisations are not a government department or a bank. They are a services business, a retailer, an agency, or an operator running a handful of platforms that matter enormously to them and are assured far more lightly than they would like to admit. This chapter is the general case, and almost everything in it applies whatever you sell.

Section 01Typical workloads

Client and brand platforms

Dashboards, performance reporting, campaign and spend visibility, self-service portalsThe defining property is that several clients' data lives in one system. A cross-client read is not an incident you recover from quietly; it is the one that ends contracts.

Marketplace and channel operations

Listings, inventory sync, pricing and promotions, order and returns flow across marketplaces and storefrontsIntegration-heavy by nature, holding long-lived credentials with genuine commercial power — the ability to change prices, alter listings, or spend an advertising budget.

Advertising and marketing operations

Audience building, spend automation, attribution and reporting pipelinesConsumer personal data plus consent state plus a credential that can spend money unattended.

Commerce and fulfilment

Storefronts, checkout, stock, warehouse and courier integrations, customer service toolingPayment-adjacent even where payment itself is outsourced, and directly revenue-affecting when it breaks.

Internal tooling

Operational dashboards, workflow automation, data pipelines, the scripts that quietly run the businessThe fastest-growing category, the least reviewed, and now the one most likely to be written end-to-end by an AI assistant.

Section 02The threat picture

• Cross-client and cross-brand leakage. The commercially fatal failure. It is almost never a sophisticated exploit — it is a query that forgot its scope, a report that widened, a cache keyed carelessly, or a new endpoint that inherited access it was never meant to have. Generated code chose the insecure implementation about 45 per cent of the time where a secure option existed.^[2]
• Third-party credentials with spending power. Marketplace, advertising, payment and logistics tokens are typically long-lived, broadly scoped, and stored as strings in environment variables. Coding agents have been documented silently reading exactly those files, and a single indirect injection has made major agents leak environment credentials at developer privilege.^[9] A leaked marketplace token is not just a data breach; it is an account somebody else can operate.
• Dependency-heavy stacks. This sector builds on the most package-dense ecosystems there are — the mean production application in a corpus we measured carries roughly 135 direct runtime dependencies.^[14] Self-replicating package worms have compromised hundreds of packages with tens of millions of weekly downloads, and did not check who was downstream.^[7]
• Personal data, consent and erasure. Marketing and commerce systems hold personally identifiable information (PII) at volume — contact details, behavioural profiles, purchase history — under UK GDPR and EU GDPR and their equivalents elsewhere. A right-to-erasure request must reach derived tables, audience exports, analytics extracts, caches and every partner platform a segment was pushed to. Most organisations can delete the row; far fewer can evidence that they reached everything downstream of it.
• Small teams, machine-scale output. AI assistance has raised what a small team can produce far faster than it has raised what a small team can review. Where there is one person who reads everything, that person is now the constraint on the whole business.
• Platform dependency risk. A suspension, an API change, or a policy enforcement against your marketplace account is an existential operational event, and the integration code that triggers it is usually the least examined in the estate.

Section 03What is used today, and where it runs out

Section 04What changes

Client separation stops depending on anyone remembering

Where the authority handed to a request is scoped to one client at the moment it is issued, code holding it cannot name another client's data. Not "is unlikely to" — cannot. A new endpoint, a new report, or a feature written overnight by an assistant does not inherit reach by being in the same codebase.

For an agency or a multi-brand operator, this is the single most valuable property in the briefing, because it converts your largest commercial risk from something you manage into something the build establishes.

Marketplace and platform credentials stop being strings

A credential held as an authority rather than a value cannot be printed, logged, serialised, or read by code that was not handed it. There is nothing in the repository to find and nothing in the environment to enumerate — which is exactly what the documented exfiltrations depended on. The ability to spend an advertising budget becomes something a specific component holds, not something the whole process can reach.

The security questionnaire gets answers you can actually evidence

Most questionnaire answers today are assertions about intent. Several of the hardest ones become mechanical:

• How is client data segregated? — by a property the compiler checks, enumerable per component.
• What third-party access does the application hold? — a checked signature, not an inventory somebody maintains.
• How do you handle a GDPR erasure or subject access request? — classification travelling with the PII through every tier it is placed in, rather than a runbook somebody follows.
• What runs during your build? — nothing a dependency supplied, and the artifact is reproducible.

That is a commercial argument as much as a security one. If enterprise procurement is standing between you and larger contracts, the ability to answer structurally rather than reassuringly is worth real money.

The dependency surface shrinks rather than grows

A large share of a conventional application's dependency graph exists to make the front end, the back end and the data layer agree: validation on both sides, serialisation, client type generation, schema tooling, adapters. Where one description generates all of it, that category has nothing to do — and the dependency you removed cannot be compromised, abandoned, or require patching at eleven at night.

Speed stops paying for assurance

This sector feels that trade more directly than any other, because delivery speed is the product. Assurance work that happens after writing competes with delivery for the same people. Assurance carried by the language is established when the code compiles — so a small team can move at the speed AI assistance makes possible without the review queue becoming the thing that decides how fast the business goes.

Section 05Questions worth asking

Useful immediately, whatever you are building on today.

• If a new endpoint were written tonight by an assistant, what would stop it reading another client's data — a property, or somebody noticing?
• Which credentials in our estate can spend money or change a listing, and what could read them right now?
• How many of our security questionnaire answers could we actually demonstrate if a client asked us to prove one?
• Who reviews the internal tooling — the pipelines and automations that run the business — and when did that last happen?
• If our output doubled again, which of our controls would become a formality?