Languages
Go
Rust
C
C++
Zig
TypeScript
JavaScript
Java
Kotlin
C#
Python
Swift
PHP
Objective-C
Dart
Find security flaws in your critical code.
We trace inputs, permissions, state changes, and dependencies through backend services, libraries, and infrastructure code.
Technology coverage
Languages we work with.
We review code in these languages and their relevant frameworks and libraries. Smart-contract languages are listed on our smart contract security review page.
This list is not exhaustive.
Discuss your codebase.
Tell us the language, repository size, and the flows you want reviewed.
What we review
Follow input, authority, state, and dependencies through the code.
Inputs
Untrusted data, messages, files, requests, events, and boundary validation.
Identity & authorization
Authentication, roles, ownership, delegation, and policy enforcement.
State & business logic
Invariants, sequencing, concurrency, retries, accounting, and intended behavior.
Sensitive actions
Signing, secrets, payments, configuration, administration, and deployment.
External dependencies
Libraries, services, parsers, cryptography, and the third parties behind them.
Failure & observability
Error handling, logging, monitoring, exposure, recovery, and fail-open behavior.
Review scope
Choose what to review
Critical component
Review a bounded service, library, client, agent, or subsystem with disproportionate impact.
Critical path
Trace signing, authorization, settlement, recovery, or automation across repositories.
Release or change set
Evaluate a major change, migration, integration, or security-sensitive diff in context.
Our approach
How we review your code.
Build the threat model
Agree repositories, target commits, and critical components. Map actors, inputs, trust boundaries, and dependencies that could expose sensitive data or actions.
Trace critical paths and define invariants
Follow authorization, privileges, and state changes through the code. Document the security properties each path must preserve.
Review the code and write tests
Manually examine failure paths and validate reachable flaws with targeted tests. Add regression tests to your repo and record the results against the invariants.
Verify fixes and document conclusions
Document affected code and remediation, always verify fixes through retesting, and record unresolved findings. Tie the principal’s signed opinion to the reviewed commit and evidence.
What you receive
What your team receives.
Findings report
Where the flaw sits in the code, what it lets someone do, and what to change.
Threat model
Actors, trust boundaries, and attack scenarios, including those blocked by existing controls.
Record of flows and security properties tested
Critical paths through inputs, authorization, and state changes, with the security properties each path must preserve.
Invariant register
Each security property, its test result, and supporting evidence.
Security tests in your repo
Regression tests alongside the code, so your engineers can verify fixes and check future changes.
Signed opinion on a reviewed commit
The principal’s conclusions, tied to the reviewed commit, scope, and evidence.
Your review team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Łukasz Mikuła
Specialist Advisor
Offensive security specialist with 10+ years of experience, 100+ public audits across 8+ ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
Published reports
Reports from related reviews
Each report includes the full findings and severity ratings.
Jump DeFi
Backend & Frontend Security Assessment
Critical Indexer Crash Due to Invalid UTF-8 Character
NEAR- Off-chain
Rust
TypeScript
Spin Finance
Onchain Orderbook and Perpetual Trading Security Review
Critical Order Placement with Negative/Zero Margin Ratio Is Possible
- NEAR
Smart contract- Rust
NEAR Intents
NEAR Intents Passkeys Pull Request Security Review
Medium Potential DoS of The Main Functionality Through Malicious Solvers
- NEAR
Passkeys- Rust
FAQ
Frequently asked questions
Is this the same as running SAST?
No. Tools can support the work, but the service is a manual review of logic, trust boundaries, state, privilege, integrations, and exploitability.
Which languages do you review?
Support depends on the assigned reviewers and codebase. We confirm languages, frameworks, build requirements, size, and critical components during scoping.
What do you need to scope the review?
We need access to the code, alongside architecture documentation, build instructions, tests, critical workflows, your main concerns, and your deadline. We arrange secure repository access during scoping.
Can you review one critical workflow?
Yes. A critical-path review can be more useful than uniform review when one flow controls funds, privileges, signing, settlement, or recovery.
Should we combine this with a penetration test?
Combine them when both implementation depth and deployed attack-path validation matter.
Can you work with a private repository?
Yes. The repository does not need to be public. We agree access and confidentiality requirements during scoping, including how to share code and documentation.
How do you verify fixes?
We always provide remediation guidance and verify fixes. We review the changes and rerun the relevant tests or reproductions. The final report records the remediation status and any unresolved issues.
Related services
Other ways we can help
Penetration Testing
Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
Explore 
Smart Contract Security Reviews
Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
Explore 
AI & Agent Security
Review models, data, tools, memory, identity, permissions, approval gates, and high-impact actions.
ExploreShow us the critical code.
Describe the codebase, critical workflow, and deadline. We will help define the review scope.
Discuss your scope