Continuous Retest
Ongoing fix-verification for your bounty program or product. When a fix ships, we verify it. You close reports with confidence, and your engineering time stays on the roadmap.
Why this exists
Fix verification is the quiet bottleneck of security work. Engineering closes a ticket. The researcher re-reports because the fix missed the real issue. Trust drains. We break that loop: every remediation gets adversarially retested, and only verified fixes get closed.
What you get
Verified closures
Each reported issue gets re-tested against the fix. Reproduction steps re-run, bypasses attempted, and a written verdict: verified-fixed, still-open, or fixed-with-caveats.
Regression eyes
Fixes that break other things get flagged. A patch that closes one path and opens another is worse than no patch.
Bounty triage support
For bounty programs: a second opinion on reports, severity calls that hold up, and duplicate detection before a reward is paid on a bad ticket.
Rolling watch
Retests of anything new you ship, on the cadence we agree. It's the difference between "we fixed it" and "we fixed it, verified".
How it works
1 · Onboard
We sign scope and authorization for the targets once. New targets get added by amendment, not renegotiation.
2 · We watch
You ping us when a fix ships (or we watch the changelog, your call). Findings get retested within the SLA we agree.
3 · You close
Every verdict lands in writing: usable in your tracker, your bounty platform, or a report to your customer.
Start a retainer
Tell us what you're working with and we'll come back with a plan and a price, usually within one business day. Every engagement starts with a signed agreement on scope and authorization.