About us, web & API pentesters in France.
We run every engagement end to end, on web and API scopes, from France, and we are also active researchers on public bug bounty platforms. Each activity feeds the other: bug bounty keeps an offensive practice sharp on real, competitive scopes, and pentesting puts it to work for one specific company, within a written framework.
At a glance
- What we doWeb and API penetration testing, from scoping to retest.
- Bug bountyActive researchers on YesWeHack and Intigriti.
- LanguagesEngagements and reports in English or French.
- CommitmentThe same people from start to finish, with nothing subcontracted.
Vulnerabilities found across these sectors
- Public services (.gouv.fr)
- CAC 40 groups
- Luxury leaders
- National media
- Local authorities
Two crafts that feed each other.
In bug bounty, a flaw someone else already reported earns you nothing. You have to go further than everyone else. Do it long enough and going further becomes second nature.
That is the reflex we bring to every penetration test. We do not stop at a checklist: we also look for what others may have missed.
Penetration testing adds what a company expects from a provider: a framework, a written scope, a complete report, and someone to talk to when it is time to fix. The two crafts complement each other, and that combination is what you get with us.
Bug bounty
- Programs opened by the companies themselves
- Hundreds of researchers on the same targets
- A reward for every validated flaw
It teaches you to dig further than everyone else.
Penetration test
- An engagement dedicated to your application
- A scope and a window agreed with you
- A complete report, a debrief and a retest
It puts that experience to work for your company.
Two different formats, the same way of searching. Turn the card.
Where we have found vulnerabilities.
Vulnerabilities found, reported and fixed on French public services, CAC 40 groups and luxury leaders, among others. Scopes and companies are never named.
reports sent with a critical vulnerability
Out of more than 485 reports sent, in penetration tests and bug bounty.
reports sent in total
In penetration tests and bug bounty.
Active in bug bounty
Researchers on YesWeHack and Intigriti, two European bug bounty platforms where every flaw is checked before it is accepted.
A practice kept up
Bug bounty is not a line on a résumé: it is an ongoing activity on public platforms, where results are validated by the organizations' own security teams before they are rewarded.
Discretion both ways
No pentest client is named on this site, no scope is described, and the published examples of flaws are always rewritten to remove anything that could lead back to anyone.
Listed on Cybermalveillance.gouv.fr.
France's national assistance service for victims of cyberattacks counts us among its listed professionals.
Cybermalveillance.gouv.fr is run by a public interest group, GIP ACYMA, which the French government set up in 2017. It helps victims, raises awareness of digital risks and tracks the threat, for individuals, businesses, nonprofits and local authorities.
A victim can be put in touch there with a listed professional. After an attack on a website, a computer or a backup, or after a scam, we step in remotely or on site in Rouen and the surrounding area: we find out how the attacker got in, measure what was exposed, then check that the fixes really close the hole.
About the serviceWhat we will not bend on.
Six principles that hold on every engagement, whatever its size.
We do the work ourselves
There is no sales layer between you and the work, and that is deliberate. The person you scope the engagement with is the one who tests, who writes, and who picks up the phone six months later if a question comes back. Nothing is subcontracted.
Our tools cover, we search
Our in-house tools cover what is known and leave nothing mechanical out. No tool result goes into a report without being replayed and confirmed. What you pay for is the time spent on what is specific to you.
We turn down what we do not do
In penetration testing, we do web and APIs: no native mobile, no industrial systems, no large-scale internal infrastructure audits. After a hack, we also work on computers, servers, backups and connected devices. When a request falls outside that, we say so and point elsewhere rather than learn at your expense.
We write to be read
A report only its author can understand is a failed report. The summary speaks to leadership, the technical detail to developers, and every flaw can be reproduced without us.
We warn you right away
A critical vulnerability cannot wait for the report. It is reported the same day, with what you need to contain it immediately, even if that shortens the engagement.
We check after you
An audit without a retest leaves a list of fixes nobody has confirmed. The retest is part of every engagement, and its result is written down in black and white.
What every engagement puts in writing.
Trust does not replace a document. Here is what is signed or provided on every engagement, without you having to ask.
Every engagement
- A confidentiality agreementSigned before you share the slightest technical detail.
- A penetration test authorization agreementSigned once the quote is accepted: the scope, the test window and the URLs covered.
- Explicit rules of engagementNo denial of service, nothing destructive, no data taken beyond the proof.
- A timestamped test logSo our activity can be told apart from a real attack in your own logs.
- GDPR-compliant data handlingWith the evidence destroyed after the agreed retention period.
Signed first, destroyed last. Engagement data has an agreed lifetime, from the NDA to the erasing of the evidence.
Why us rather than a large firm?
Two concrete reasons. The person who sells you the engagement is the one who does it, which is not always the case elsewhere: you meet an expert in pre-sales, and a junior shows up after signing. And there is no sales structure or project management layer to pay for in the price. In return, we do not take on scopes outside our field, and we say so rather than subcontract.
What kinds of companies do you work with?
Mostly software vendors and online platforms, as well as online stores and business applications. Size matters less than what is handled: a small team hosting sensitive data needs an audit more than a large group whose website is a brochure.
Do you work outside France?
Yes, engagements are run remotely and we work in English and in French. Where the company is located does not matter. What matters is the legal framework of the penetration test authorization agreement, signed for each engagement.
What happens to what you find out about us?
Nothing leaves. The NDA is signed before any technical exchange, the evidence and engagement data are destroyed after the agreed retention period, and no client or scope is ever named, including in the examples published on this site.
What does “listed on Cybermalveillance.gouv.fr” mean?
Cybermalveillance.gouv.fr is France's national assistance service for victims of cyberattacks. The listing covers helping victims: it rests on a voluntary application and on signing the platform's charter of commitments (fair business practices, confidentiality of client data, sharing technical details about the threat). It is not the same as the ExpertCyber label, which is granted after an audit.
Read further.
What we do, how, and what you receive.
All services
The six services, and which one fits your project.
See the pageOur methodology
The frameworks, the phases and the rules of engagement of every engagement.
See the pageSample report
The deliverable in detail, with one flaw documented end to end.
See the pageWhat a pentest costs
Our pricing, and what is always included.
See the pageLet's talk about your scope.
The first call is there to find out whether we have something useful to offer you. If we do not, we say so. No commitment.