Full authorized test
We hunt for every hole we can find in the business systems you authorize — not a light scan for show.
Flat package
$1,000 authorized engagement.Refund if no Critical in scope.
Pay us to break it on purpose. Full authorized testing, logs of what we touched, flat price. Binding Critical definition and refund rules appear in the SOW. Mock payment on this site until a provider is chosen.
Included
What the package covers
Logs of everything we touched
You get evidence and logs showing what we accessed and what we tried, so you see the work — not just a summary slide.
Flat $1,000 package
One price to break it on purpose before a malicious actor does. Start intake on this site; SOW is binding. Mock payment until a provider is chosen.
Money-back if no Critical in scope
Full refund when no Critical (as defined) is found in scope — subject to exclusions and the signed contract.
Critical definition
The refund trigger — stated plainly
Aligned with ExploitGenie README §5 framing for this draft. Final language is SOW-only.
- 01
Bulk PII exposure (validated read)
Confirmed read access to bulk personally identifiable information outside intended authorization.
- 02
Remote code execution / pre-auth RCE
Ability to execute attacker-controlled code on an in-scope system, including pre-authentication paths.
- 03
Full session takeover
Account or session compromise that yields durable control of an authenticated identity in scope.
- 04
Unauthenticated DoS at scale
Practical denial-of-service against an in-scope service without credentials, at operationally meaningful scale.
Money-back protections
Full refund if no Critical in scope
When the engagement completes under the SOW and no Critical (as defined in that SOW) is found in scope, the package fee is refunded in full — unless an exclusion applies.
Exclusions (draft)
- — You revoke permission or block testing mid-engagement without a written change.
- — Legal or infrastructure blocks make testing impossible after kickoff.
- — Phishing / social-engineering work (priced separately unless explicitly in SOW).
Request engagement
Start intake. Mock pay at the end.
Required: permission, domain, founder LinkedIn, one app URL, threats you worry about. Everything else is optional. Entity formation is in progress.