During design
Challenge trust assumptions before they become expensive to reverse.
Choose the review your system needs.
Each targets a different layer of the system. Find yours below, or tell us the scope and a principal will point you to the right review.
What we review
What do you need reviewed?
Choose the closest review target. If your scope crosses categories, we can combine the relevant expertise into one engagement.
Smart Contract Security Reviews
Find flaws in contract logic, permissions, accounting, and upgrades before they put funds at risk.
Explore
Blockchain Protocol & Infrastructure Reviews
Review custom chains, runtimes, nodes, consensus, and bridges beneath the application layer.
Explore Penetration Testing
Test the attack paths that connect web, mobile, APIs, cloud, identity, and infrastructure.
Explore Signing & Custody Security Reviews
Review key generation, signing approvals, key use, and recovery across MPC, HSM, multisig, and custody platforms.
Explore Cryptography Reviews
Review ZK circuits, custom primitives, signature schemes, privacy protocols, and post-quantum designs before you build on them.
Explore Secure Code Reviews
Find security flaws in critical code, including authorization, business logic, and state changes.
Explore AI & Agent Security
Review models, data, tools, memory, identity, permissions, approval gates, and high-impact actions.
ExploreTiming
When to bring Guvenkaya in
Before launch
Review the system once its behavior and critical paths are stable enough to test.
Before a major change
Reassess after an upgrade, a migration, or a change to who holds the keys.
After an incident or concern
Reconstruct failure paths and identify the changes needed to prevent recurrence.
Our approach
How we scope and run your review.
Define the scope and outputs
Identify the system or change to review. Agree the boundaries, exclusions, and evidence needed for your decision.
Map the threats
Document the actors, assets, trust assumptions, and failure scenarios relevant to the scope.
Review and record the evidence
Assign specialists for the system under review. Examine the controls and document findings with supporting evidence.
Verify fixes and deliver conclusions
We always verify fixes through retesting and record unresolved findings. Deliver the agreed outputs with conclusions tied to the reviewed scope.
Your review team
Meet the specialists
A principal leads each engagement. Your proposal names the specialists assigned to the scope.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Łukasz Mikuła
Specialist Advisor
Offensive security specialist with 10+ years of experience, 100+ public audits across 8+ ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
Published reports
Reports from related reviews
Each report includes the full findings and severity ratings.
NEAR Intents
NEAR Intents Security Review
Medium Potential Funds Stealing From Users Via Repeating Failed Intents
NEAR
Intents
Rust
Sailor Lend
Web Application Security Review
Critical Vulnerable to React2Shell
Web application
TypeScript
Virto Network
Pallet Pass Security Review
High DoS of The Main Functionality Through Session Key Hijacking
Polkadot
Substrate- Rust
Spin Finance
Onchain Orderbook and Perpetual Trading Security Review
Critical Order Placement with Negative/Zero Margin Ratio Is Possible
- NEAR
Smart contract- Rust
FAQ
Frequently asked questions
Do you verify fixes?
Yes. We always provide remediation guidance and verify fixes through retesting. The final report records the remediation status and any unresolved findings.
Which review does our system need?
Start with the system or change you want assessed. A principal helps identify the relevant code, infrastructure, cryptography, or operational scope. Work spanning several areas can be combined in one engagement.
What do you need to scope the work?
Describe the system, your main concerns, and your deadline. Share architecture documentation and details of the environment. For any review that includes code, we need access to that code to define the scope and estimate the work. We agree how to exchange confidential material during scoping.
What determines the price and duration?
The scope, technical complexity, available documentation, and depth of testing determine the effort. Access requirements and the included retesting also affect the schedule. The proposal sets out the scope, timing, and fee.
Who will carry out the review?
Your proposal names the principal and specialists assigned to the engagement. A principal stays involved from scoping through delivery.
Related services
Other ways we can help
Secure Architecture & Process Design
Design or assess critical systems, workflows, integrations, and operating controls before implementation or a major change.
Explore 
Risk Assessment
Give leadership a prioritized view of where security risk concentrates and what to address first.
Explore 
Technical Training & Security Exercises
Choose training on Rust, Substrate, and NEAR, or workshops, tabletop exercises, and key-ceremony rehearsals tailored to your systems.
ExploreDiscuss your security review.
Describe your system, main concern, and deadline. We will help define the scope.
Discuss your scope