A vulnerability is a rumour until something runs.
The security research arm of Skull Solutions: we find how software fails, prove it, and tell the people who can fix it.
Got a question first?
- Every finding proved, not scored
- Vendor first, ninety days
- You talk to the researchers
we read other people's code.
We look for the flaws in software that is already shipped and deployed, before they turn up in somebody's advisory.
proof, not a score.
A crash is not a vulnerability. We build the smallest thing that runs, so a fix is prioritised on evidence and not on a guess.
vendor first, then published.
We tell the vendor privately, give them ninety days, and publish either way. The clock is the same for everyone.
tools fall out of the work.
Harnesses, triage, instrumentation: we build what the research needs when the existing tools fall short, and hand it over with a clear licence.
want your app tested?
We research software flaws. A review of your own application is Skull Solutions' work, and they are built to do it.
Visit Skull SolutionsStart here
Go straight to what you need
-
How research runs
From target to disclosure, including empty results.
-
What you can hire us for
Research, exploit development, and tooling.
-
How we disclose
Vendor first, ninety days, published either way.
-
Where our work stops
Our scope and firm limits.
Something you want looked at?
Tell us what the target is and what you need to know about it.