~/services/cybersecurity

Cybersecurity audits and penetration testing

We find the flaw in your system before someone else does, and hand you the patch written, not just the finding. On your own systems and with written authorisation.

Free diagnosis

The problem

Most breaches do not arrive through a sophisticated attack. They arrive through a key written into the code, an endpoint that returns another user's data if you change an identifier in the request, or a dependency with a vulnerability published eight months ago.

And there is a second, more expensive problem: an 80-page report nobody applies. A finding without the fix written next to it sits in a folder until someone makes use of it.

What we review

Authorisation and data access

If changing an identifier shows another client's data, that is the breach. It is the most common flaw and the most serious one in any multi-client application.

Secrets and injection

Keys and credentials in the repository and in git history, SQL and NoSQL injection, XSS, and validation that only exists in the browser and not on the server.

Dependencies and infrastructure

Published vulnerabilities in what you already run, server and TLS configuration, and exposed ports and services nobody remembers opening.

Smart contracts

Contract review before deployment, where the mistake cannot be patched afterwards: reentrancy, access control, arithmetic and assumptions about transaction ordering.

About proof

We do not publish client audits

A security report is confidential by definition: publishing a client's flaws would be the exact opposite of our job. What you can look at is what we secure daily — a production blockchain with a nine-validator consensus, a neobank and an ERP with accounting inside. Systems that move money and have been running for months.

See the projects →

What you usually ask before signing

Are you going to take my system down?: We do not work against production without explicit agreement, and destructive or denial-of-service testing is out of scope unless asked for and scheduled. The scope is signed before anything is touched.
What if you find something serious halfway through?: You hear about it there and then, not at the end in the report. A critical flaw waiting two weeks for the closing meeting is a critical flaw exposed for two weeks.
Do I just get a list of problems?: No. Every finding comes with its severity and the specific fix, ready to apply. If you want, we apply it and check it again.

When did anyone last look at your code?

If the answer is “never” or “years ago”, start with the diagnosis. It is free and it tells you where the problems would begin.