Request an audit

1. 01

   You pick a time for a 30-minute call

   Sending the note takes you to the calendar. If you would rather not book, we reply by email within two business days. A senior reviewer, not a sales sequence: if the work fits, we come with the questions we need answered; if it does not, we say so and point you at whoever it fits better.

2. 02

   You get a written scope and a fixed estimate

   What is in, what is out, how long it takes, and what it costs, agreed before any work starts. Changes after that are written amendments, not mid-engagement surprises.

3. 03

   Work starts under a mutual confidentiality agreement

   Our standard agreement binds both sides for three years after the work ends. Anything we find is yours: we do not publish a finding, a report, or your name until you clear it in writing.

Prefer not to use a form? Write to [email protected] and ask for an encrypted channel before you send anything sensitive. And never send private keys, seed phrases, or production credentials, here or anywhere else: our agreement states we will not ask for, generate, import, or keep them.

How long does an audit take?

It depends on the size and complexity of the scope. Once we have reviewed your repo and agreed the scope, we propose a timeline and commit to it. Remediation verification is scheduled inside the engagement, not added afterwards.

How much does it cost?

Pricing follows scope: the amount of code, its complexity, and the depth of testing you need. We quote after scoping, and the estimate is fixed before the audit begins, so there are no surprises mid-engagement.

How do I prepare?

Freeze the commit you want reviewed, share the repository and any design or threat-model documents, and note what is in and out of scope.

What happens if vulnerabilities are found?

You receive each finding as we confirm it, with a severity, the exploit path, and a recommended fix. Your engineers ship the fixes, we retest them, and the final report records what was resolved and what remains open.

What is included in the report?

Scope and methodology, a severity-ranked list of findings with remediation guidance for each, retest status, and an executive summary you can share with partners, investors, and exchanges. Publication is your decision.