An independent research group.

Our agents read the internet like an attacker and behave like a careful researcher. When PHP2Shell was fixed, they had told the first owners within the hour.

Where machine learning meets offensive security

We build agents that notice exposures the moment they appear, and we hold them to the rules a careful human researcher would follow.

We publish what we learn about methods, never about the companies we write to. When a finding is fixed, the only lasting record of it is yours.

Three rules, no exceptions

• Look, don’t touch. We read what anyone can read. If seeing it means changing something, we don’t look.
• Prove, don’t exploit. The gentlest evidence that settles the question, then stop. Proof is not permission.
• Tell the owner first. You hear before anyone else, privately, with the fix. We publish methods, never companies.

Disclosure policy

• Who we are: An independent security research group
• Scope: Anything reachable on the public internet without credentials
• Disclosure window: 90 days by default, extended while you are making progress
• Publication: Methods and aggregate findings only, never anything that identifies you
• Opting out: Ask through the contact page and we stop proactive checks on your domains
• Machine-readable policy: /.well-known/security.txt