Payments & fintech
binary review · api surface · retest
Card-present terminals, ledger and settlement services, and the internal APIs that never appear in the public documentation.
anonymised track record
Track Record Without The Names
every engagement on this page is described so that it cannot be walked back to whoever paid for it.
- sectors
- payments · gaming · saas · infrastructure · crypto · defence supply
- attribution
- role and sector only
- published detail
- none, by contract
Sectors served
Six sectors, listed by where the work goes rather than where it sells. Each line is the shape of engagement that sector tends to buy - not a specific one, and not a specific buyer.
Gaming & anti-cheat
client re · kernel surface · bypass mapping
Shipped game clients, the integrity checks inside them, and the drivers those checks are trusting to tell the truth.
SaaS platforms
authz review · api surface · retest
Multi-tenant products, where the expensive bug is a tenancy boundary rather than a memory corruption.
Critical infrastructure
protocol analysis · lab replica · segmentation review
Operational networks and the gateways bridging them to corporate IT. Testing runs against a replica; a live process is never a target.
Crypto & exchanges
key handling · withdrawal path · code review
Custody and signing paths, withdrawal logic, and the operational steps wrapped around both. Read-only against anything holding value.
Defence suppliers
scoped assessment · written brief · controlled handling
Work arrives through a prime contractor with the boundary already drawn. Their handling rules come attached to the scope and are followed to the letter.
The logo wall, withheld
- ███████
- █████
- █████████
- ██████
- ████████
- █████
- ███████
- ██████
Most security pages open with a wall of customer logos. Each of those is either a signed marketing permission or a liberty taken with somebody's disclosure terms. Every engagement here runs under a mutual NDA signed before scoping, and that NDA covers who the client is, not only what was found - so a logo on this page would breach the same agreement that made the work possible. Ask about it during scoping and you will get the same answer about your own name.
Engagement classes
These are classes of work, not case studies. Each describes a kind of engagement run more than once, with every identifying detail removed rather than blurred. Nothing below points at a single party.
Payment terminal firmware and its update path
Target class. A family of card-present terminals and the signed update bundle behind them, on bench units supplied for the engagement.
Approach. Unpack every release in the archive, diff them, then work the verification and recovery paths rather than the application sitting on top. No production estate was touched at any point.
Outcome. Weaknesses in the update chain, each written up with a procedure the client's own engineers ran before the report was accepted. Corrected in the following release train, with the retest already inside the original scope.
Game client integrity and anti-cheat
Target class. A shipped client and the kernel-assisted component it trusts to tell it the machine underneath is clean.
Approach. Reverse the integrity checks, build a harness that exercises them the way a cheat author would, and map bypasses by class instead of demonstrating one trick and calling it a finding.
Outcome. A written account of which checks survive a determined attacker, which only deter casual tooling, and which telemetry is worth the cost of collecting. Nothing was published, nothing was sold, and the material stayed with the studio.
Multi-tenant authorisation in a SaaS product
Target class. The tenancy boundary of a business platform: object ownership, background jobs, export paths and webhook replay.
Approach. Manual review end to end, with scanner output treated as a lead and never as a finding. Accounts on both sides of the boundary, provisioned by the client rather than created by me.
Outcome. Cross-tenant reads reachable through paths that never appear in the interface. Each reproduced from the report by the client's team, fixed, and confirmed on a retest against the same scope.
Gateway between an operational network and corporate IT
Target class. A protocol gateway bridging a segmented plant network to the business side of the same organisation.
Approach. Read-only analysis against a lab replica built from the client's own configuration. Written authorisation from the asset owner and the integrator before anything ran, and the live process was never in scope.
Outcome. The segmentation assumptions in the architecture document, tested one at a time, with the captured traffic that disproved several of them attached. Remediation ordered so it fitted an actual maintenance window.
Unattributed feedback
Two weeks in we had a written map of what an attacker could actually reach, and none of it was speculative. Our own engineers reproduced every item before we accepted the report.
We were told which of our checks were theatre. That was uncomfortable, and it was the point - the next build shipped knowing what it did and did not stop.
Scope was fixed before anything started and the invoice matched it. The retest was in the original number and it happened when it was supposed to.
Attribution stops at role and sector: a quote specific enough to trace is a client specific enough to identify. Wording is paraphrased and stripped of anything identifying, so read these as positioning rather than as references. Real references are offered privately, with the client's written permission, once an engagement is far enough along to warrant asking for it.
How client work runs
The same sequence every time, whether the engagement is a two-week review or a year of retained research. None of it is optional, and all of it is on paper before anything is touched.
- 01
Mutual NDA
Signed before scoping, not after, because scoping is where the sensitive detail starts moving. It covers who you are as well as what I find, which is the reason this page has a redacted strip where a logo wall would be.
- 02
Written scope
A statement of work naming targets, methods, windows and what is explicitly out of bounds, signed by somebody with the authority to authorise it. No scope, no testing - including for anything the target depends on but does not own.
- 03
Encrypted channel
Mail encrypted to the PGP key on the contact page, or a dedicated channel agreed at kick-off. Findings, credentials and captures do not travel in plaintext and do not sit in a shared inbox.
- 04
Evidence handling
Captures, artefacts and anything extracted live on encrypted storage that exists for that engagement alone. No shared drives, no third-party note-taking, no screenshots left in a chat history. What goes in the report is the minimum needed to reproduce the finding.
- 05
Data destruction
At close-out everything client-derived is destroyed and you get written confirmation of it. The signed scope and the invoice are retained because tax law says so; the material is not kept as a portfolio, and nothing from it reappears on this site.
next step
Your name will not appear here either
Send the target class and a timeline. Mutual NDA first, written scope second, work third. You get a fixed quote or a clear no.