Web & API security services, one standard.
We are security researchers based in France. Our job is to attack your applications before someone else does it for the wrong reasons, then hand you what you need to fix them. Here are our six services: five to test before, one to respond after a hack.
At a glance
- Six servicesWeb penetration testing, API audit, WordPress, website audit, authentication and access control, incident response.
- What they shareOur in-house tools cover what is known, and hands-on expertise goes after what is specific to your application.
- Out of scopeIn penetration testing: native mobile, industrial systems and internal infrastructure. We say so rather than subcontract.
- The first stepA scoping call, free and with no commitment.
Vulnerabilities found across these sectors
- Public services (.gouv.fr)
- CAC 40 groups
- Luxury leaders
- National media
- Local authorities
Test before, respond after.
Each one has its own page: what we do, how, what you get and what it costs.
Web penetration testing
Your application is live. We test it the way a real attacker would: looking for the path nobody planned for, without breaking anything and without your users noticing.
See the serviceAPI security audit
REST, JSON, GraphQL. An API answers exactly what it is asked: what remains is checking that it only answers whoever should get an answer.
See the serviceWordPress penetration testing
Plugins, themes, roles, admin surface. The WordPress core is solid. What gets piled on top much less so, and that is most often the way in.
See the serviceWebsite security audit
Brochure site, online store or CMS. Most attacks a public site takes are aimed at nobody in particular: they sweep, they find, they come back.
See the serviceAuthentication and access control
Who can really do what. IDOR, privilege escalation, isolation between customers: number one in the OWASP Top 10, and one of the hardest to catch with a tool.
See the serviceIncident response
A hacked website, computer or backup, or a scam. We step in remotely, or at your place in Rouen and the surrounding area, to contain the attack, find the way in and restore everything.
See the serviceIf a tool can spot it, so can an attacker. We look for what they haven't seen yet.
A scanner mostly finds what has already been cataloged. Many serious flaws take an understanding of your application. That is where we spend our time.
Every engagement combines our in-house tools and hands-on expertise. The tools cover what is known and leave nothing mechanical aside. The expertise goes after what is specific to your application: your rules, your roles, your user journeys.
These engagements start when you need them: before going live, after a redesign, or to settle an alert nobody can make sense of. The method stays the same. Only the surface changes.
One application, five ways in. Each testing service covers one of them, with the same method and the same report.
A practice in the field.
We are active bug bounty researchers: every flaw we report there is checked by the company concerned before it is accepted.
reports sent with a critical vulnerability
Out of more than 485 reports sent, in penetration tests and bug bounty.
reports sent in total
In penetration tests and bug bounty.
Active in bug bounty
Researchers on YesWeHack and Intigriti, two European bug bounty platforms where every flaw is checked before it is accepted.
Which one do you need?
It is not your industry that decides which service fits, it is where your project stands. These questions usually settle it.
Is your application already live?
If so, that is web penetration testing: we work on the real system, with its real data and real behavior, which a staging environment rarely reproduces exactly. If not, we scope an audit before go-live, on a representative pre-production.
Where does your sensitive data live?
If most of the business logic sits behind endpoints used by a JavaScript front end or a mobile app, that is an API security audit. It is where we find the most serious flaws today, because access control there is often assumed rather than checked.
What does the site run on?
If the answer is WordPress, the ways in are specific enough to deserve their own approach: that is what WordPress penetration testing is for.
Is it mainly there to present and sell?
If your visitors browse, fill in a form and buy, with at most a simple customer area, the risk sits in exposure and configuration: that is a website security audit.
Several roles, or several customers on one platform?
When the real question is who can reach what, authentication and access control builds the full permission matrix and checks every cell of it.
Already hacked, or caught by a scam?
A defaced site, encrypted files, an admin nobody recognizes, fake tech support: it's too late for an audit. Incident response contains the attack, finds the way in and restores your systems, remotely or at your place in Rouen and the surrounding area.
Still not sure?
Tell us about your site or app in a few lines. We will tell you which engagement fits it, or whether it is still too early for a test.
Describe my projectWhat never changes.
Whatever the service, these six points are part of every engagement.
An NDA and an agreement
The NDA as soon as we get into technical details, the penetration test authorization agreement once the quote is signed, before any access.
A set test window
A test window agreed in advance, known only to you if need be.
A prioritized report
Prioritized by real severity, not by a theoretical score.
Reproducible proof
A proof of concept you can replay, for every flaw.
The retest, included
Every fix is retested, with no extra charge.
A debrief
A session with your teams to walk through the findings and prioritize the fixes.
Before you decide.
The price, the method, the deliverable and the people who do the work: each has its own page.
What a pentest costs
Our pricing, what moves the number and what is always included.
See the pageOur methodology
The frameworks, the phases and the rules of engagement of every mission.
See the pageSample report
The deliverable in detail, with one flaw documented end to end.
See the pageWho we are
Pentesters and bug bounty researchers, from scoping to retest, with nothing subcontracted.
See the pageLet's start with a conversation.
Tell us what you would like tested. The first call commits you to nothing. Based in France, we work remotely across Europe and worldwide, in English and in French.