Adversarial mindset
Real attacker logic. We hunt the path no off-the-shelf scanner will ever find: the business rule that bends, the role that reaches too far.
Vulnerabilities found before hackers do.
Your vulnerabilities already exist. The only question is who finds them first. We test your websites and APIs with our in-house tools and hands-on expertise, the way a real attacker would.
Vulnerabilities found across these sectors
- Public services (.gouv.fr)
- CAC 40 groups
- Luxury leaders
- National media
- Local authorities
Who better than an ethical hacker to find your vulnerabilities?
An attacker only needs one flaw. Better that we're the ones who find it. Patient, methodical, quiet: where off-the-shelf scanners stop, we keep going, until we reach the weakness that truly threatens your business. Then we give you what you need to close it for good.
Real-world rigor
Hands-on experience built on high-traffic platforms and sensitive environments. Every route, every role, checked.
Absolute discretion
Strict confidentiality, NDA as standard, encrypted reports if needed.
Proven where the stakes are highest.
Vulnerabilities found, reported and fixed on scopes where a single mistake is costly.
reports sent with a critical vulnerability
Out of more than 485 reports sent, in penetration tests and bug bounty.
+485
reports sent in total
Active in bug bounty
Researchers on YesWeHack and Intigriti, two European bug bounty platforms where every flaw is checked before it is accepted.
An audit shaped around your situation.
Launching a site or securing a service that is already live: these are the engagements we run most often.
Pre-launch audit
Catch flaws while they still cost a fix, not an incident, before your site or feature ever goes live.
Before go-liveStaging
Live production testing
Already online? We test it under real attack conditions, quietly and without breaking anything.
ProductionNo disruption
API audit
REST, JSON, GraphQL: we make sure every endpoint exposes only what it should, and only to whoever should reach it.
RESTGraphQLWebhooks
Auth & access review
Who can reach what? We hunt the access that crosses the lines you set: IDOR, privilege escalation, broken permissions.
IDORRolesSessions
Second opinion & post-incident
A doubt after an alert or a major change? We confirm what's real, qualify the impact, and document it.
After an alertImpact
Not sure which one fits?
Tell us what you are building or running. We scope the engagement together, in a first conversation with no commitment.
Discuss your needsAnything that takes a request, we'll test.
Your customer portal is a target. Websites, web apps, back offices, APIs: we test what your customers and your teams use every day, where your data, your payments and your access controls live.
Where we look.
The web layer
Websites, web apps, customer portals, client areas, back-offices and CMS: the full interface your users and staff touch.
- Websites
- Web apps
- Portals
- Client areas
- Back-offices
- SPA
- WordPress & CMS
- Payments & checkout
The API layer
REST and JSON APIs, authentication, authorization, and the third-party integrations that hold everything together.
- REST
- JSON
- GraphQL
- Auth & tokens
- OAuth & OIDC
- Webhooks
- WebSockets
- Integrations
The vulnerabilities we go after.
The doors an attacker tries to open, each in one plain line. The detail is in the report.
Injections & input
Making the app run what it shouldn't.
A script slipped into a page runs in your users' browsers.
Input reaches the database as a command instead of data.
An uploaded file ends up doing far more than sitting there.
A file path escapes the folder it was meant to stay in.
Access & identity
Seeing or doing what isn't yours.
Change an identifier, get someone else's record.
A page or action left reachable by the wrong role.
A standard account ends up with admin powers.
Logins, resets or sessions that can be sidestepped.
A logged-in browser tricked into acting on its own.
API & logic
Bending business rules and authorizations.
Endpoints that trust the caller far too much.
Admin-only functions callable by regular users.
Fields a user should never set, accepted anyway.
The rules of your business, turned against it.
Server & config
Exploiting what the server exposes or leaves open.
Your server made to fetch what an outsider chooses.
Another site allowed to read your users' data.
Keys, versions or data leaking where no one looks.
A library or CMS on a version with known flaws, still in production.
A repeatable method.
Six steps, from scoping to retest, in the same order on every engagement.
Read the full methodology- 01
Scoping
We agree with you on the scope, the rules and the testing window. The testing agreement and NDA are signed before any access.
- 02
Reconnaissance
We map everything you have exposed, including the subdomains, endpoints and forgotten flows you didn't know were still online.
- 03
Exploitation
Our in-house tools cover the surface in depth. Where a tool is no longer enough, hands-on expertise takes over and chains weaknesses into real, demonstrable impact.
- 04
Impact & proof
A reproducible proof of concept: you see exactly what an attacker could reach.
- 05
Report and debrief
Priorities both leadership and engineers can read, with what to fix and in what order, then a debrief with your team.
- 06
Retest & closure
We retest every fix ourselves: a flaw is only closed once the fix is confirmed.
What you receive after our engagement.
Work your teams, or your providers, can act on immediately, with every finding proven and explained.
bughunter.pro Confidential, under NDA
Penetration test report
Interactive sample, built from the anonymized findings below
Critical3
High1
Medium0
Over 100,000 reader profiles readable and deletable by anyone, without an account. Personal data exposed: a regulatory risk and a blow to readers' trust.
SeverityCritical, no account needed
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains each of them, ready to replay.
Check on the server, on every request, that the signed-in user is allowed to act on the requested resource, and deny by default.
PriorityImmediate, retest included
The infrastructure secrets vault was open without authentication: the keys to internal services, within anyone's reach.
SeverityCritical, no authentication
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains each of them, ready to replay.
Close public access, revoke and regenerate every exposed key, and restrict the vault to the services that actually need it.
PriorityImmediate, retest included
Premium subscriptions could be activated without paying: a direct loss of revenue.
SeverityHigh, no payment needed
Requests, screenshots and reproduction steps: redacted in this sample. Your report contains each of them, ready to replay.
Activate a subscription only once the payment provider has confirmed the payment, checked on the server, never on the browser's word.
PriorityHigh, retest included
Debrief with your team Fixed and retested
Prioritized report
Every flaw ranked by real severity and urgency, so the most dangerous gets fixed first, not the loudest.
Reproducible proof of concept
The exact steps to replay each flaw. No "maybe", no theory: proof you can hand straight to your developers.
Business impact
In plain language: what it exposes, what it could cost, and who is affected. Readable without a security background.
Concrete remediation
Not just "it's broken": how to fix it, explained so your team can actually apply it.
Retest included
Once you've patched, we re-check your fixes. The door is shut, and verified, not assumed.
Debrief & handover
A walkthrough of the report with your team, so the findings are understood and owned, not just delivered.
A few real findings, anonymized and fixed.
Each one proven, documented in a report, then fixed.
- CriticalFixed
Secrets exposure
An infrastructure secrets vault, unsealed and unauthenticated, at a large public-sector organization: the keys to everything, reachable by anyone.
- CriticalFixed
Broken access control
Over 100,000 reader profiles at a major news publisher, readable and wipeable in a single request, with no account.
- CriticalFixed
SQL injection
The full database of a news website, hundreds of tables of personal data, exportable without a single account.
- CriticalFixed
Path traversal
Arbitrary file write on a local authority's website, chained into an administrator session forged without a password.
- HighFixed
Business logic
Premium subscriptions created without paying and without an account, on a publisher's platform.
We never disclose a client's name, or any detail that could identify them. These examples are rewritten so none of them can be traced back to anyone.
Do you sign NDAs?
Yes. Confidentiality is the default, not an upsell. An NDA is signed before any scope is shared, and reporting can be fully encrypted on request.
Will you ever name my company?
Never. Your identity, your scope and every finding stay strictly between us. Discretion is part of the service.
Do you test mobile applications?
Our focus is the web and APIs. That is where we go deepest and find the highest-impact vulnerabilities. For native mobile, we will gladly refer you to a specialist we trust.
How does an engagement start?
A short scoping conversation, a signed agreement, then a defined testing window ending in a clear, prioritized report. See our methodology.
How long does an engagement take?
It depends on the scope. A focused audit can wrap in a few days. A complex application will take two to three weeks. We align on that during scoping.
How much does an audit cost?
There is no flat rate: engagements start at €2,700, and the price depends on the size and complexity of your scope. We define it together in a first, no-commitment conversation. What moves the price.
Start with a conversation.
Tell us what you'd like tested. Based in France, working remotely across Europe and worldwide, in English or French.
What happens next
- 1
A short scoping call
You tell us what matters, then we agree on the scope, the testing window and the price, with no commitment.
- 2
NDA and agreement
Signed before you share anything about your scope.
- 3
Testing, report, retest
A defined testing window, a clear prioritized report, a debrief with your team, then the retest of your fixes.