Scope

What we are not

We research software flaws. Here is where other work belongs.

Skull Solutions

Your application is the parent company's work

For a review of your application, contact Skull Solutions.

  • Application security review

    Reviews of your application's authentication, authorisation, logic, dependencies, and configuration.

  • Secure software engineering

    Fixing findings and building security-critical features.

If you write to us, we will direct you to Skull Solutions. SkullSploit is a brand of Skull Solutions Pvt Ltd, a company registered in the Maldives; the two share one company and divide the work.

Skull Solutions

At any price

Work we refuse

These requests are outside our terms.

  • Access to something that is not yours

    Only the owner can authorise access. We refuse unauthorised work.

  • Exploits sold to a buyer instead of a vendor

    We report flaws to vendors, never brokers or buyers.

  • Surveillance tooling

    We do not build tools to monitor, locate, or intercept people.

  • Silence as a deliverable

    We do not suppress findings in third-party software.

A client cannot authorise us against something that is not theirs, and asking is the end of the conversation rather than the start of a negotiation.

The disclosure policy this rests on

Elsewhere

Work we refer outside the company

Ask a specialist provider.

  • Network, wireless and physical testing

    These need specialist teams and equipment.

  • Red teaming and social engineering

    These test people and detection, not software flaws.

  • Live incidents

    Contact an incident response team.

  • Accredited audits

    Use an accredited assessor.

Not sure where it belongs?

Ask once. We will tell you who should own it, even when that is not us.

Start a conversation