Who tests your AI agents? We do.
MCP and agent audits covering tool schemas, prompt injection, and supply chain. Attack surfaces most pentest teams haven't built a method for yet.
What we do
Bug Bounty Hunting
Hands-on hunting on HackerOne, Bugcrowd, Intigriti and YesWeHack. We do the recon, work the exploits, and write reports you can act on.
Private Program Work
Invite-based programs and direct VDP (vulnerability disclosure) engagements for companies without a public program.
Web App Pentesting
Scoped web application assessments on contract. Steady work once bounty credibility is established.
Security Content
Write-ups, disclosure reports and tutorials that build public reputation. The reputation is what pulls in private invites.
Frontier AI in the hands of adversarial security engineers. Human-verified results.
Engagements
Four ways to work with us. Each one ships with a written, reproducible report.
Security Snapshot
A fast automated pass over your site: headers, TLS, exposed files, injection surface. Findings manually verified. Same-day.
from $750MCP / AI Audit flagship
Adversarial review of AI agents and MCP servers: tool schemas, prompt-injection surfaces, supply-chain checks. A report you can show enterprise buyers.
from $4,750Full Assessment
Deep multi-target assessment with manual exploitation. Scoped per engagement.
from $750/moContinuous Retest
Ongoing fix-verification for your bounty program or product. We confirm remediation so you can close reports with confidence.
Flat or retainer pricing, quoted per scope. No surprises, and the number is in writing before anything runs.
How it works
1 · You authorize
You confirm you own or are authorized to test every target. The authorization goes into a signed agreement with timestamp and IP, so both sides are covered.
2 · We test
Automated scanning within strict request budgets, rate-limited and respectful of your infrastructure. Then a person verifies every finding. Nothing automated ships unconfirmed.
3 · You get the report
Every finding comes with reproduction steps, business impact, and remediation guidance. Results land in your inbox. Paid engagements get the full written report.
4 · We retest
Fix what we found and we retest it. The verified-clean follow-up is something you can show customers, auditors, or your bug bounty program.
Trust & guarantees
Signed agreement, every time
Before any testing starts, both parties sign a written security testing agreement covering authorization, scope, what we do and don't do, liability, and confidentiality. No handshake deals.
Payments handled by Stripe
Card details never touch our servers. Checkout and payment processing run entirely on Stripe's infrastructure. Taxes calculated automatically at checkout.
Your data stays yours
Findings and engagement details are confidential. Raw testing data is deleted within 30 days of report delivery, as written into our standard agreement.
No fake findings
We never inflate severity or pad reports. If we find nothing, the report says so. Reputation is the product.
Get in touch
Tell us what you're working with and we'll come back with a plan and a price, usually within one business day. Every engagement starts with a signed agreement on scope and authorization.
Working with us. Want your web app, API or disclosure program looked at by people who do this for a living? Every engagement comes with a clear, reproducible report. No noise, just findings. Questions first? Email [email protected].