Engagements
Security engagements
Authorized, ethical security work for teams shipping smart contracts, Rust services or web apps. Fixed scope, fixed fee, real reports, responsible disclosure. The same eye I bring to finding CVEs, pointed at your stack.
Smart contract audit
Fixed-fee review of Solidity and Rust protocol code, with proof of concept and fix verification.
- A threat model and invariant list agreed before the review starts
- Severity-ranked findings with proof of concept for High and Critical
- Fix verification: each finding marked fixed, partially fixed or acknowledged
- A coverage statement naming commits, files and exclusions
- An exit call with your engineers, plus a public-ready report on request
- timeline
- 5 to 10 business days, fixed scope
- price
- from $6,500
Rust security audit
A fixed-scope review of unsafe code, FFI boundaries, panic paths and dependencies.
- A threat model specific to your system, agreed before testing starts
- Severity-rated findings with proof-of-concept and a clear reproduction path
- Concrete remediation guidance — code-level where possible, with the reasoning
- A live readout call with your engineers so the fixes land
- A retest of your fixes after remediation
- timeline
- 1 week, fixed scope
- price
- from $5,000
Web application penetration test
Authorized, scoped testing of a web app or API, end to end.
- Authenticated and unauthenticated testing within the agreed scope
- Severity-rated findings with reproducible proof-of-concept for each
- A clear narrative of the impact in plain terms, not just a CVSS score
- Concrete remediation guidance your engineers can act on
- A retest of fixes after remediation
- timeline
- 1 to 2 weeks, scoped
- price
- from $5,000
Security retainer
A monthly review window for teams that ship continuously.
- A fixed number of review days each month, scheduled in advance
- Written review notes per change, with severity and a clear go or no-go
- A direct channel to me for the duration of the retainer
- A monthly summary of what was reviewed, what was found and what remains open
- timeline
- Monthly, 3-month minimum
- price
- from $4,500 / month
How an engagement works
Every engagement is authorized and scoped in writing. No surprises, no grey areas.
- 01
Scope & authorization
We agree the targets, rules of engagement, and written authorization before anything is tested.
- 02
Testing
Hands-on, methodical testing within scope — the same depth I bring to bug-bounty work.
- 03
Reporting
A clear report: severity-rated findings, reproductions, and concrete remediation guidance.
- 04
Responsible disclosure
Findings stay between us. Nothing is published without your sign-off.
Questions buyers ask
How fast can you start?
Scoping within 24 hours and kickoff as soon as 72 hours after the scope is signed and repository access is in place. A rush start is available at a 40% surcharge.
What do you need from us?
Repository access at a specific commit, the architecture note, known issues, deployment plans, and any prior audit reports. If the docs are thin, the kickoff call fills the gaps.
Do you sign an NDA?
Yes. I can sign your NDA, or use a short mutual one. Findings stay between us and are never published without your written consent.
What if you find nothing?
You still get the report and the coverage statement: what was reviewed, at which commit, and what was explicitly out of scope. A clean result from a named reviewer is a useful artifact, not a wasted week.
Do you verify the fixes?
Yes. Every engagement includes at least one fix-review round. Each finding is marked fixed, partially fixed or acknowledged, with my verification rather than the team’s word for it.
References available on request. No client names or numbers are published without written consent.
How I test, in public
The method behind the findings: request smuggling, race conditions, broken access control, and blind SSRF.
Have something that needs testing?
Send the repo and the architecture note. You get a fixed scope and a date.