Security & data handling

Don't send us secrets

Never submit credentials, API keys, tokens, or source code through this website or by email. Our intake is designed so they are never required. If we ever need a secret rotated or shared, we'll use a secure, agreed channel — not a web form.

Least access, scoped and temporary

• Read-only access is preferred wherever it is sufficient
• Access is scoped to what the engagement actually requires
• Access is temporary and you control removal at any time
• Reports and working materials can be deleted on request

Authorized, advisory scope

We work only on systems you own or are authorized to engage us on. This is an advisory assessment — not unauthorized testing, exploit development, or a penetration test against production unless you explicitly scope and approve it.

What we're actually assessing

AI agents introduce a distinct risk class. Our framing follows recognized references such as the OWASP Top 10 for LLM Applications (notably LLM01 prompt injection and LLM06 excessive agency) and the “lethal trifecta” — the combination of access to private data, exposure to untrusted content, and a path to exfiltrate. The goal is to reduce and contain that exposure, not to claim it can be eliminated.

Reasonable, not absolute

No assessment makes a system unhackable. We bound the blast radius of a compromised or misled agent and give you a prioritized plan — honest about residual risk.