Independent security lab
Offensive security research and testing.
We find and report vulnerabilities in browsers, operating systems, and developer tooling, and we bring the same depth to penetration testing across web applications, cloud systems, and the platforms teams rely on.
What we do
Three lines of work, one standard: nothing leaves our hands without a researcher having verified it.
Penetration testing
Depth-first assessments of web applications, cloud systems, and the platforms you most need to trust, with every finding reproduced by hand.
The offering →02Vulnerability research
Original research into browsers, operating systems, and the tooling teams build on.
Current focus →03Coordinated disclosure
Findings reported to the vendor first and published only after a fix has shipped.
How we disclose →Penetration testing
Thorough where it counts, verified by a human.
We take on a small number of penetration testing engagements each quarter, led by the researcher behind the advisories on this site. Each one goes deep on the systems you most need to trust rather than running a broad scan across everything.
We use automation, including tools that use AI, for the parts of an assessment that reward covering a lot of ground quickly. Today that means Claude Opus 4.8 from Anthropic, run through Claude Code. A researcher reviews what the tools produce, does the actual testing, and confirms every finding by hand. Nothing goes into a report that we have not reproduced ourselves.
- 01
Scanning and enumeration
We map the attack surface and run broad scanning, including tools that use AI, to surface anything worth a closer look.
- 02
Review and prioritization
A researcher reads through the results, clears out the false positives, and decides where the time is best spent. A scanner result is a lead, not a finding.
- 03
Testing and verification
The actual testing is done by hand. We reproduce each issue against your environment and work out its real impact before writing anything down.
- 04
Reporting and retesting
You get a written report with severity, steps to reproduce, and guidance on fixing each issue. Where it helps, we build a working proof of concept your team can run and assess for themselves. Once your fixes are in place, we retest to confirm they hold.
We treat client findings the way we treat our research. They are yours, and we do not sell them or publish them.
Advisories
Apple Security Research
- CVE-2026-84559CoreServices permissions issue allows a malicious application to access restricted files
- CVE-2026-84508CodeSigningHelper lets an unentitled app read any root-readable file
- CVE-2026-43785File Bookmark permissions issue allows writing to a read-only file
- CVE-2026-43735WebGPU importExternalTexture bypasses cross-origin video pixel protection
Vulnerability Disclosure Programs
Current focus
- WebKit and Safari. Cross-origin boundaries in the GPU and media pipelines, and the process model that backs them.
- macOS platform security. Entitlement surfaces and inter-process boundaries reachable from web content.
- Developer tooling and AI agent infrastructure. Trust boundaries in toolchains that execute untrusted input.
Lead researcher
Merrick Hare
Research, disclosure, and vendor coordination. Credited by Apple in the Safari 26.5.2 security release and by ESA in GHSA-g49g-f3f6-g578. More at merrickhare.com.
Disclosure
Vulnerabilities are reported directly to the vendor and held until a fix ships. We do not sell findings, and we do not publish details, proof-of-concept code, or vendor case references before remediation.
Advisories are published after the patch is generally available and independently verified against the shipped build.