Five phases. Zero theater.
This is the exact process behind every finding on our record. Disciplined, authorized, and built to produce evidence — not slide decks.
Recon & Attack Surface Mapping
Days 1–3Before touching anything, we map everything: domains, subdomains, API endpoints, JavaScript bundles, mobile app assets, third-party integrations, staging environments, forgotten admin panels. Most critical findings are visible from this phase alone.
Exploitation & Proof-of-Concept
Days 4–7Within the authorized scope, we actively exploit. Exposed tokens are validated. Auth bypasses are demonstrated. Data exposure is proven on real records — because a finding without proof is just a guess, and guesses don't get remediated.
Evidence Collection & Reporting
Days 7–9Every finding is documented like it will be read by three audiences: your engineers (reproduction steps), your management (business impact), your lawyers (regulatory exposure). Includes extracted evidence, severity scoring and concrete remediation guidance.
Responsible Disclosure
Day 10Findings go directly to you — encrypted channel, named contacts, no intermediaries. We don't set disclosure deadlines, don't threaten escalation, don't go public. You decide the timeline. Our job ends when you have everything needed to fix it.
Remediation Verification
After your patchA fix that looks closed but isn't is worse than no fix — it creates false confidence. After you patch, we re-run the exact exploit path to confirm the vulnerability is actually dead. Included in every engagement.
Rules of engagement
- Written authorization before any active testing
- Scope agreed upfront — domains, apps, depth
- No destructive testing: no DoS, no data modification, no spam
- Extracted evidence is minimal, encrypted, and destroyed after the engagement
- All findings remain confidential — disclosure is your decision
