Sourced / For security and engineering teams
Security testing
for what you ship.
Find the risks that matter.
Give your team a clear path to fix them.
Web applications / APIs / AI systems
Built around your next decision
Move forward with
the risks in view.
Bring the product, the deadline and the question you need answered. We help turn them into a focused security review.
Give buyers clear evidence.
Understand the risks before your next customer security review.
Check what changed.
Test a new application, sign-in flow or permission model before launch.
Know what tools can reach.
Review agent permissions and data boundaries before expanding access.
Web applications
Sign-in, roles, account recovery and the paths that handle sensitive data.
Protect the journeys your customers rely on.APIs
Authorization, tenant boundaries and what each caller can read or change.
Trace access from the request to the record.AI apps
Prompt injection, tool permissions and data access across agent workflows.
Define what the model and its tools must not do.A report your team can use
From evidence
to action.
See the issue, understand the impact and follow a clear path to a fix. Explore an illustrative finding below.
A user can read another workspace's record
The API accepts a record ID without checking that the signed-in user belongs to its workspace.
GET /records/record-bWorkspace B recordEvidence
An authorized test account receives a synthetic record owned by the second test workspace. The same request with the record owner's test account confirms the expected access path.
Remediation
Check workspace membership on the server before returning the record. Apply the check to every record access path. Add a cross-workspace regression test.
Retest criteria
Reject the cross-workspace request. Confirm that the record owner still has access. Record the tested version and the result for each path in the agreed retest scope.
For your security lead
An executive brief with risk priorities, business impact and review limitations.
For your engineering owner
Reproducible findings, supporting evidence, remediation guidance and retest criteria.
For procurement
Documented scope, methods, deliverables and agreed retest terms for your review process.
Your engagement, step by step
From the first question
to a verified fix.
Agree on the scope, price and schedule before work starts. Keep a clear record through testing, remediation and the agreed retest.
- 01
Agree on scope
Define targets, test accounts, exclusions, timing and a contact for issues. Record written authorization before testing.
- 02
Test and document
Test the agreed paths. Record evidence, impact and limitations so your team can understand each finding.
- 03
Remediate and retest
Use the report to plan fixes. Agree on the retest scope and timing, then check the fixes against the original findings.
Pilot / A separate initiative
Sourced Access
A clearer boundary for agent access.
Explore secrets, tool permissions and offboarding with us. Bring the workflow your team needs to improve.
Access is a pilot, not a production, audited or generally available product. Participation terms and capabilities are not final.
Explore the Access pilotBefore you start
A few clear answers.
Can this support an enterprise security review?
Yes. The report gives your team documented findings, evidence, scope and methods to discuss with a buyer. Share the buyer's requirements during scoping so we can agree on the right deliverables. A review is not a certification or a guarantee of buyer approval.
How do we agree on price and timing?
Tell us which systems you need reviewed and your deadline. We agree on scope, access, deliverables, price and schedule before work starts. Retest coverage and timing are defined in the engagement terms.
How do you handle access and sensitive data?
We agree on test accounts, data handling, permitted methods, test windows and stop conditions before testing. Send no credentials or customer data in your first message. Access arrangements follow the agreed scope.
What happens after we contact you?
We discuss your application, deadline and priorities, then define the proposed review. An inquiry does not authorize testing. Work starts only after verified authority, written authorization and an agreed scope.
Your next review starts here
Know what needs fixing.
Give your team a way forward.
Tell us what you are shipping and when. We will help define the review.