Security tools that are themselves secure.
A security product runs with more privilege and holds more sensitive data than almost anything else you could build. It is also a target precisely because of that.
What usually breaks.
Runs as root, everywhere
Agents and scanners given full privilege because it was the fastest way to make them work. One bug in your tool is now a full compromise of every host it touches.
Logs you can edit
If an attacker can rewrite your security logs, your logs are decoration. Append-only storage and integrity checks are rarely in the first draft.
Your own supply chain
A dependency scanner that pulls forty unpinned packages of its own. The tool checking for supply chain risk is the supply chain risk.
What we'd do about it.
Security Hardening
Least-privilege boundaries, pinned and audited dependencies, secrets kept out of memory dumps, and defaults that are safe when nobody configures anything.
Bug Fixing & Code Rescue
Tamper-evident logging, clean separation between the privileged and unprivileged parts, and error paths that fail closed instead of open.
QA & Testing
Adversarial testing of your own tool: what happens when the thing it is scanning fights back.
Fair things to ask.
You'd be reviewing a security product. Isn't that a bit odd?
It's the most useful place to have a second pair of eyes. Security tools run with more privilege and hold more sensitive data than almost anything else.
Will you sign an NDA?
Yes, before we see anything at all.
Our agent runs as root on every host.
Then one bug in your tool is a full compromise of every host it touches. That's the first thing we'd look at.
Can you review our detection logic?
We review the software. Detection quality is your domain expertise and we won't pretend to out-know you on it.
What about our own supply chain?
Pinned and audited dependencies. A scanner that pulls forty unpinned packages of its own is the risk it's scanning for.
Do you do red teaming?
No. We do code-level review and targeted testing of your product. Red teaming is a different discipline.
How do you handle what you find?
Privately, to you, the day we find it. It goes nowhere else. Not into a blog post, not into a conference talk.
Can you get us SOC 2 ready?
We can do the engineering side. The audit itself is between you and your auditor.
Working on something in Cybersecurity?
Send us the repo. We'll tell you what's wrong with it before you commit to anything.
Start a handoff