home / methodology
// how we test
Depth over speed, proof over claims
The same repeatable, manual-first process on every engagement — whether it's a web app, a mobile app, a cloud review or a bug bounty triage. It's the discipline we use when we hunt bounties ourselves: go as deep as the evidence and authorization allow, and never report anything we can't reproduce.
// the process
Seven stages, every time
Hunting is non-linear — we move between recon and hunting as new leads appear — but every engagement runs through all seven stages before it closes.
- 01
Scope & authorize
Nothing is tested until a signed authorization letter names the in-scope assets, exclusions and excluded vuln classes. No scope, no traffic.
- 02
Recon
Enumerate subdomains, live hosts, ports, endpoints and user roles. We go deep — correlating live crawling, JS analysis and historical assets — until discovery hits genuine diminishing returns.
- 03
Learn & model
Fingerprint the stack, threat-model the app, study how its developers think, and prioritise the highest-value targets before we attack.
- 04
Hunt
Test each endpoint for its matching bug classes and chain them into real impact. Manual-first — scanners assist, people prove.
- 05
Validate
Every candidate passes a strict gate. We prove impact end to end and kill false positives. One wrong answer and the finding is dropped.
- 06
Report
Executive summary plus per-finding CVSS 3.1/4.0, evidence, reproduction steps and developer-ready fixes.
- 07
Retest
After you fix, we retest each finding once and confirm closure — so the engagement ends with risk closed, not just listed.
// standards
Mapped to recognised standards
We don't invent our own checklist. Every engagement maps to the standards your auditors, customers and developers already know.
OWASP WSTG · ASVS
The Web Security Testing Guide and Application Security Verification Standard, plus the OWASP API Top 10.
OWASP MASVS · MASTG
The Mobile Application Security Verification Standard and its testing guide, for Android and iOS.
CIS Benchmarks
Provider-specific hardening baselines for AWS, Azure and GCP.
MITRE ATT&CK
Red-team activity and SOC detections both mapped to the ATT&CK matrix.
CVSS 3.1 & 4.0
Severity scored with the official calculator — no hand-waved ratings.
OWASP LLM & ASI
For AI features: the OWASP LLM Top 10 and Agentic (ASI) risks, when they're in scope.
// what we test for
The bug classes we hunt
Each discovered endpoint is auto-triaged to its matching attacks — then proven by hand.
Access control
IDOR, broken function-level auth, multi-tenant isolation, privilege escalation.
Injection
SQLi, NoSQLi, command injection, SSTI and cross-site scripting.
Server-side
SSRF, request smuggling, deserialization, file-upload and path traversal.
Auth & session
Auth bypass, JWT algorithm confusion, OAuth/SAML flaws, 2FA bypass.
Business logic
Workflow abuse, race conditions, price and quantity tampering.
API & GraphQL
Mass assignment, verb tampering, GraphQL introspection and object-level auth.
// our promises
Prove, don't claim
Two rules sit above everything else, borrowed straight from how good bounty hunters work.
Every finding is reproduced
“Could potentially chain” is not a finding. We land the proof-of-concept end to end before it reaches your report — and we never submit the always-rejected noise like missing headers alone.
Depth until diminishing returns
A scanner reporting zero new URLs does not mean zero new findings. We keep correlating independent techniques until the attack surface is genuinely explained.
See it on paper
The methodology is only as good as the report it produces. Download an illustrative sample to see exactly what you'd receive.