Trust

Security and disclosure

Last updated 14 August 2026

We sell security testing. Holding ourselves to a lower standard than our customers would be indefensible.

Reporting a vulnerability

Report it to [email protected]. Tell us what you did, what came back, and how to reproduce it. We will confirm receipt and tell you what we found.

What we ask while you look: test only against your own account, do not run automated scanners at the service, do not attempt denial of service, and do not access, modify or delete another customer's data. If you reach something that is not yours, stop and tell us.

How customer data is protected

The evidence behind every finding is sealed to the account it belongs to before it is written down, under a key scoped to that account. Account details are sealed the same way.

One function decides what any given viewer may see, and every customer-facing surface goes through it: the dashboard, the report, the PDF and the live event stream. There is exactly one place to audit.

Every outbound request the scanner makes is pinned to an address proven public, and re-checked on every redirect hop. The scanner cannot be steered onto an internal address or a third party.

Our own posture

Every change to this service is attacked on a private copy before it reaches production. An attacker model tries to break it, a second frontier model verifies what it claims, and the deploy stops if anything stands up. We run our own product against ourselves.

The ledger on our main page is the result of our own scanner pointed at our own site, published whichever way it comes out. Read it.