Questions we get before the signature.

Yes. Always, no exceptions. Before anything runs, both parties sign a security testing agreement that records the authorization, exact scope, request budgets, and rules of engagement. If you own the target, that's a five-minute step. If you don't own it, we can't help until you do.

Authorization to test, the exact targets (domains, apps, endpoints), what we will and won't do, rate limits and testing windows, confidentiality and liability terms, and how raw data is handled: deleted within 30 days of report delivery. Both sides get a signed copy.

A focused adversarial review of an MCP (Model Context Protocol) server or AI agent: prompt injection, tool schema abuse, excessive agency, data exfiltration paths, and supply-chain risk. It's our flagship service. See the full MCP/AI audit page.

No one can honestly guarantee that about any system, AI especially, since behavior is probabilistic. What we guarantee is process: adversarial testing by people who do this for a living, every finding reproduced by hand, and fixes verified with a retest. "Verified-fixed" is the strongest claim we make, and we stand behind it.

Yes, but within request budgets you approve, rate-limited, and respectful of your infrastructure. Nothing automated ships in the report unverified. Scanners buy breadth; people buy accuracy.

Then the report says "no significant findings", and that is a genuinely useful result. It means an adversarial pass could not find what an attacker might. You're still charged, because the work was done.

Flat, per engagement, based on scope: number of targets, authentication depth, urgency, complexity. You see the price in writing before anything runs. Details on the pricing page.

Through Stripe only. Checkout, invoices and taxes all run on Stripe's infrastructure, so card details never touch our servers.

We help with the parts around a program: triage, retests, severity calls, program review. We don't host or operate a bounty platform. If you're getting reports and drowning in them, Continuous Retest was built for you.

Just a rough idea of what you want checked and why. Scope details, a budget range and a timeline let us reply with a real quote in one round instead of three.

Yes. Confidentiality is mutual and standard for us. Send yours or use ours, whichever your process prefers.

Yes, we hunt on public and private programs continuously. It keeps our offensive skills current. That is exactly why you want us testing your product.