Services
What we do
Three areas of work, each scoped in writing before it starts.
Vulnerability research
We look for security flaws in software, firmware, and network-exposed systems, work out their root cause and real-world impact, and document them so they can be fixed.
- Software: applications, services, and libraries.
- Firmware: embedded devices and the software that runs on them.
- Network-exposed systems: services and protocols reachable over a network.
[PLACEHOLDER: vulnerability research detail: typical targets, methods, and what a client receives]
Security assessments and code review
We assess the security of a product, system, or codebase against an agreed scope, and report what we found, how we found it, and how to fix it.
- Security assessments of applications and systems.
- Source code review focused on security defects.
- A written report with findings, evidence, and remediation guidance.
[PLACEHOLDER: assessment detail: engagement types, deliverables, and how scoping works]
Coordinated vulnerability disclosure support
We help researchers and vendors handle a vulnerability report properly: reaching the right contact, agreeing a timeline, and publishing accurate information once a fix is available.
- For researchers: reporting a finding to a vendor and managing the conversation.
- For vendors: receiving reports, triage, and advisory drafting.
- CVE ID requests and advisory publication.
[PLACEHOLDER: disclosure support detail: who this is for and how an engagement runs]
To discuss a piece of work, contact us. Our own reporting practice is described in the disclosure policy.