Web and API penetration testing
Your web app and API, attacked by hand.
We break software for a living. Then we build it properly.
Hands-on penetration testing for web apps, APIs, smart contracts, mobile, cloud and firmware. We show you how we got in, and how to close it.
Halls of fame and bounties: teams that credited or rewarded our founder’s reports
- NVIDIA
- SimScale
- Oracle
- Kraken
- Apple
- USAA
- Indeed
- NASA
- FFmpeg
- Vercel
- Acronis
- Lightspark
- Anthropic
- Nextcloud
- McDonald’s
- Fireblocks
- AXIS OS
- Zendesk
- Binance
- Asana
Web3: audits and rewards
- VeChainThor
- Multipli Smart Contracts
- Internet Computer Protocol (ICP)
- Snowbridge On-Chain Code
- Olas
- Injective Peggy Bridge
Every bug we find in someone else’s code is one we won’t ship in yours.
Smart contract audits
Solidity read line by line, then fuzzed until it breaks or holds.
Mobile and desktop app security
The app and the API behind it, taken apart against MASVS.
Network and cloud security
Your perimeter, internal network and cloud accounts.
Firmware and IoT security
We pull the firmware apart and go after the device.
Open-source security
Dependencies, CI pipelines and clean upstream disclosure.
300+
Vulnerabilities reported
Independent research since 2022
If we can’t prove it, it’s not in the report
No scanner dumps. No inflated severities.
- A fixed quote, agreed before we start
- Free retest of everything you fix
From first call to closed findings
Learn
Scoping
One call on targets, rules and dates. Then a fixed quote, in writing.
Fixed quote
Learn
Recon
Hosts, endpoints, roles, versions and the third-party code you lean on.
Attack surface map
Learn
Threat model
Who would attack this, and where would they push first?
Test plan
Attack
Testing and exploitation
Hands-on, inside the agreed dates. Criticals reach you straight away.
Confirmed findings
Close
Report
Severity, evidence, reproduction steps and a fix for every finding.
The report
Close
Remediation
Your engineers fix. We answer their questions.
Answers while you fix
Close
Retest
Free, inside an agreed window. Each fix confirmed closed.
Free retest
Then we build it properly
Nothing we build ships until we’ve tried to break it. Plumb, Aegis and imgosint included.
All build services
Web applications and APIs
Web apps and APIs, attacked before they ship.
Mobile apps
Android and iOS apps that keep data on the phone.
Desktop apps
Native software that handles files carefully and asks before it acts.
Security tooling and DevSecOps
Scanners and CI checks that catch problems before they ship.
Built in-house
A Mac app, an Android app and an image verification tool.
Plumb
Shows developers what deleting caches, toolchains and app data on a Mac would really give back.
Aegis
Checks your Android apps on the phone itself: which hold sensitive or special access, and whether any match published stalkerware indicators.
imgosint
One picture, several public search engines, and every candidate it can fetch measured on your machine.
On the record
CVE
CVE-2026-43816, credited by Apple
A kernel out-of-bounds write, fixed across Apple’s 26.6 releases.
CVE
CVE-2022-21500, credited by Oracle
E-Business Suite, CVSS 3.1 base score 7.5.
Recognition
NITI Aayog Frontier Tech Hub
Profiled in “Guardians of the Grid”.
As featured in
- WION
- The Hindu BusinessLine
- Indiatimes
- ABP Live
- DNA
- ANI
- Inshorts
- The Better India
- Daily Excelsior
- Greater Kashmir
- Kashmir Life
- Free Press Kashmir
Who does the work
I started breaking into software in 2022, with permission. Three hundred-odd reports later, Apple put my name on a kernel CVE. Vulnara is the same work, done for you, under contract.
Muneeb Amin Bhat
Founder and principal security researcher
Tell us what to break. Or what to build.
Send the scope and your deadline, and we’ll set up a call.