Resources

Methodologies

How we actually run an engagement, published so you can hold us to it.

Showing 2 of 2 items — 2 still being written, and each one says so on its own page.

MethodologyFeaturedPDF, 9 pages
How we score severity, and why we show the adjustment
CVSS v4.0 base plus an environmental adjustment, with the reasoning stated in one sentence per finding — including the cases where we adjust a score up. Published so you can disagree with us precisely rather than generally, and so an auditor can see the number was reasoned rather than assigned.
Imran Haque · 11 Feb 2026Read methodology
MethodologyPDF, 14 pages
Web application and API testing methodology
Scope, phases, coverage against OWASP ASVS 4.0 and WSTG, what we confirm by hand versus what tooling covers, the escalation path for a critical found mid-engagement, and the explicit list of what we do not test and why.
Imran Haque · 20 Jan 2026Read methodology