App Security

Hunt authentication and authorization bypasses in guards, roles and tenants

Test for broken function-level authorization across REST, GraphQL and gRPC

Run a white-box bug bounty hunt on open-source projects with disclosure programs

Route CI/CD pipeline attack testing by provider and workflow surface

Test CI jobs for secret and OIDC token exposure after code execution

Hunt OS command injection where user input reaches shell or exec calls

Apply evidence-led methods for smart contract audits and evidence review

Run the smart contract audit lane with Slither, Foundry PoCs and DeFi playbooks

Hunt LLM training data and model poisoning in fine-tuning and feedback loops

Hunt insecure deserialization across Java, Python, .NET, PHP and Ruby

Read source code around scanner candidates to confirm real vulnerabilities

Hunt LLM excessive agency where agents hold too many tools or permissions

Find GitHub Actions expression injection and pull_request_target misuse

Hunt insecure direct object references and missing object-level authorization

Hunt LLM output handling flaws that let model text drive XSS or code execution

Hunt LLM overreliance where wrong outputs feed automated decisions

Review mobile apps for insecure storage, hardcoded secrets and weak certificate checks

Hunt single-block and spot-price oracle manipulation in smart contracts

Find and validate vulnerability variants by diffing vulnerable and fixed code

Write minimal, verified patches for confirmed security findings

Hunt directory and archive traversal from user input to file operations

Search the codebase for every instance of a confirmed bug's root cause

Test CI pipelines for poisoned build files and fork-PR trigger abuse

Hunt prompt injection and tool-call hijacking in AI-integrated applications

Hunt JavaScript prototype pollution that chains into RCE on Node.js stacks

Hunt ReDoS regexes with catastrophic backtracking and prove timing impact

Hunt and validate reentrancy bugs in cross-function and read-only variants

Sweep very large codebases in shards to flag candidate security issues

Hunt LLM leaks of PII, secrets and other-tenant data through model outputs

Hunt signature replay flaws from missing nonces and chain IDs

Hunt SQL and NoSQL injection through source-level taint tracking

Hunt server-side request forgery through taint analysis to HTTP clients

Hunt server-side template injection and validate its path to code execution

Hunt LLM supply chain risks in models, datasets, plugins and MCP servers

Hunt LLM system prompt leaks that expose rules, secrets and tool lists

Map trust boundaries and audit startup config loading in developer tools

Hunt LLM denial-of-wallet and resource exhaustion through unbounded requests

Hunt upgradeable proxy bugs like storage collisions and open initializers

Hunt RAG and embedding flaws that leak data across tenants or inject prompts

Verify candidate bugs with minimal proof-of-concept tests and CVSS scores

Hunt XML external entity flaws and validate file read and SSRF impact

Run a quick security check of code against the OWASP Top 10

Score a project's security posture with a full audit and findings

Quick scan of config files against a database of known security threats

Scan code for vulnerabilities, dangerous patterns and leaked sensitive data

Install and sign in to the 1Password CLI and inject secrets into commands

Run a security checklist for auth, user input, secrets and payment features

Scan agent skills, plugins and MCP servers for prompt injection and secret leaks

Vet third-party agent skills for red flags and risky permissions before install