Contact us
Accepting new client engagements

Start an engagement.

Tell us about the systems you want examined. A researcher, not a salesperson, will read your message and reply with questions and a proposed scope.

Send an engagement inquiry

The button below opens your email client with this template filled in. The more detail you share, the faster we can scope.

Inquiry template 
Name:
Organization and role:

Service of interest (web app / API pentest, external / network pentest, AI and LLM testing, ongoing security team, other):

Systems in scope (applications, domains, repositories, models):
Anything explicitly out of scope:

Authorization: I own these systems or have permission to commission testing (yes / no):

Timeline or deadline:
Compliance or reporting requirements:
Budget range (optional):

Anything else we should know:
Email your inquiry

Direct contact

What happens next

  1. We reply and ask questions

    A researcher reads every inquiry and follows up to understand your systems and goals.

  2. Scoping call

    A short call to agree targets, boundaries, timing and what a useful result looks like.

  3. Written scope and authorization

    Rules of engagement and permission are documented and signed before any testing starts.

  4. Research, report, retest

    Validated findings with evidence and fixes, followed by a retest once you remediate.

Coordinated disclosure

Reporting a vulnerability or coordinating a disclosure?

Whether you are a vendor contacted by us, or a researcher with a finding, write to the same address with the subject "Vulnerability disclosure".

Report an issue
Questions

Before you reach out

What kinds of organizations do you work with?

Companies, nonprofits and open-source projects that run internet-facing applications or build software others depend on. If you are unsure whether we are a fit, ask.

Do you sign NDAs?

Confidentiality is the default for every engagement. If you need an NDA in place before sharing details, say so in your inquiry and we will arrange it before scoping.

Will you publish anything about our systems?

Not without your agreement. Client findings stay confidential. Public writeups only happen through coordinated disclosure that you have approved.

Can you test systems we do not own?

No. We only test with documented authorization from the system owner. Third-party services need their own permission.