Security lead whose inbox is full of low-value reports
An open disclosure address attracted automated scanner output and nobody has time to sort the genuine findings from it.
Run a bounty without drowning in noise
We set the scope, the rewards and the safe harbour terms, then triage every report so your engineers only see the ones that are real.
What arrives
- Scope and safe harbour terms researchers can rely on
- Reward tiers tied to real impact rather than scanner severity
- Triage of every submission, with duplicates and noise filtered out
- Confirmed findings written as tickets your engineers can act on
Who this is for
Three profiles. If none of them is recognisably you, this is probably the wrong page - and the line below is the one worth reading before you book anything.
Not a fit: Skip this if your application has never had a security review, because a bounty will surface the same basic findings at a higher price.
Product company preparing for enterprise customers
Buyers ask whether you run a disclosure programme, and the honest answer is currently no.
Engineering lead who wants continuous testing
An annual review is not catching enough, and hiring a full-time security engineer is not affordable yet.
What you get
- Scope and safe harbour terms researchers can rely on
- Reward tiers tied to real impact rather than scanner severity
- Triage of every submission, with duplicates and noise filtered out
- Confirmed findings written as tickets your engineers can act on
- A researcher communication policy, so reports get answered on time
- A monthly summary of what came in, what was real, and what it cost
What we build it with
- HackerOne
- Bugcrowd
- GitHub Issues
-
Jira
- Semgrep
- Burp Suite
Chosen per project, not per fashion. If your team already runs something else and it works, we use that.
How the work runs
-
1
1-2 weeks
Readiness
We check the application is worth opening to researchers, and fix the obvious findings first.
From you: An honest view of what has and has not been reviewed before.
-
2
1 week
Define
We write the scope, the exclusions, the safe harbour terms and the reward tiers.
From you: A budget ceiling, and legal sign-off on the safe harbour wording.
-
3
2-4 weeks
Launch
We open the programme, privately at first, and widen it once the report volume is understood.
From you: A named contact for anything needing a product decision.
-
4
Ongoing
Triage
We validate every submission, reject noise with a reason, and route real findings to your tracker.
From you: An engineer who can pick up tickets within an agreed time.
How we work together
Fixed project
Scope and price agreed up front. Best when the outcome is known and the deadline is real.
Dedicated team
A named team for a quarter or more. Best when the roadmap will change and you want the context kept.
Staff augmentation
Engineers inside your process and your tools. Best when you have the lead and need the hands.
Invoiced in
- USD
- EUR
- GBP
- CHF
- SGD
- AUD
- CAD
- AED
- SAR
- QAR
- JPY
- INR
Paid by
Card, netbanking, wallet and UPI through Razorpay, which is what our checkout runs on, so anything it accepts we accept. Bank transfer, SEPA, Wise and Payoneer for invoices that prefer it.
NDA before the first call. Full IP assignment on delivery. Contracts under Indian, English or Delaware law.
Work like this
Case studies are being written up
Three are in legal review. We can walk you through the work on a call in the meantime, including the parts that did not go to plan.
What clients say on Google
Live from our Google Business listing - not retyped here.
Loading reviews from Google - read them on Google.
Questions we get asked
You set a ceiling and we run inside it. The larger cost is usually triage time, not rewards, which is the part we take on. Starting private with a small researcher group keeps volume predictable for the first months. We report monthly on what came in and what was paid, so the number never surprises you.
Scope and safe harbour, both written before launch. Scope names what may be tested and what must not be touched, and requires a test account rather than real customer data. Safe harbour tells researchers acting in good faith that you will not pursue them, which is what keeps findings coming to you rather than going elsewhere.
No. A bounty is expensive at finding the basics, because you pay per report for things a single review would have caught in a week. Get a review done, fix what it finds, then open a bounty to catch what the review missed and what arrives with new code. We will say plainly if we think you are not ready.
We do, within the response times set in the policy. Researchers judge a programme by how fast it replies and whether rejections come with a reason, and a programme that goes quiet gets written about publicly. Anything needing a product or payment decision comes to your named contact with our recommendation.
Thinking about opening a programme?
Tell us what you have already had reviewed, and we will say whether a bounty is the right next step.