Client Portal / Fortuna Security
Manual testing revolved around structured playbooks which incorporate python, bash, Industry-recognized tools, and AI. For the bug bounty audit, we test for most recent dangers, led by news of zero day vulnerabilities. For the OWASP top 10 audit, we follow the guidance of an internationally recognized authority in CyberSecurity, OWASP and conduct up to 100 separate tests against the 10 most common exploits to occur in 2025. We would share and discuss the scope together, and we'll report findings in language you and your engineers can act on. Our members hold CompTIA CySA+, Security+, A+, Network+, Offensive Security OSCP, and more. Need a specific certification for regulatory reasons? Tell us and we'll talk it through.
Certifications held across the team
Identified, exploited & remediated
11+
Findings disclosed and remediated across client engagements to date.
Manual pentest success
100%
We've found at least one vulnerability, exploited it, and remediated it per client.
Offensive security team
5members
We operate our plans with clear structure and guidance.
Client check-ins
Weekly
We meet once a week, when possible, to discuss findings and progress.
Whether it's the $500 OWASP audit or a bounty contract, every engagement runs the same five steps, bound by the written scope you sign before anything is touched.
We agree in writing what's in bounds, what's off-limits, and what "done" looks like. Every system, domain, and IP address is named before anything is touched.
We map what's actually exposed: domains, endpoints, technologies, and services, strictly inside the signed scope, so testing starts from your real attack surface.
Automated tooling covers the breadth; senior testers work by hand for depth. Every candidate finding is proven with a working proof of concept before it's reported.
Each finding arrives with its CWE (and CVE where one exists), a CVSS score, and a remediation plan. Discoveries reach you through a secure channel within 12 hours.
You fix, and we re-verify that the fix holds. The OWASP audit includes one retest pass, and we meet weekly, when possible, until the work is closed out.
Our five-member offensive team works from an in-house playbook built out of prior engagements, so no one starts from zero. We plan together and split the scope into tasks and responsibilities. We meet with you once a week, when possible, to go over findings and progress. When we find something worth escalating, we tell you right away, with enough detail to establish the finding and set expectations for payment before the bounty is settled.
5 members · 1 playbook · weekly check-in
A manual assessment of every category on the OWASP Top 10:2025 list, reported with CWE, CVSS, and remediation notes. Findings come back re-verified once your fixes ship.
Users acting outside intended permissions, reaching data or routes the policy should have blocked.
Insecure defaults, missing headers, exposed services, or stack-level permissions left too loose.
Compromised dependencies, build pipelines, registries, and third-party code trusted without proof.
Weak, missing, or misapplied crypto: sensitive data exposed in transit or at rest.
SQL, NoSQL, command, or template injection reaching the runtime.
Missing or ineffective control design: architectural flaws no later patch will undo.
Broken login, session, recovery, and credential flows that let the wrong actor walk through.
Unverified updates, CI artifacts, plugins, or serialized data crossing trusted boundaries.
Missing or unclear logs and alerts: the SOC learning about the breach from a customer.
Errors and edge cases that fail open, crash silently, or leak internal state.
A flat fee opens the engagement, then payouts track severity. The engagement runs for up to three months and closes on a written debrief. Low-severity findings are on us, and so are medium findings that don't affect your business.
Opens a contract of up to 3 months
A flat fee, starting at $50 and scoped to the size of the service, for signing terms and laying out what's in bounds, what's off-limits, and what "done" looks like. A $50 monthly fee covers each month the engagement runs. It just gets the clock started; what the engagement earns depends on what we deliver.
Free to $200 per finding
Once the agreement is signed, we hunt. Each finding comes with a working proof of concept, its CWE (and CVE where one exists), a CVSS score, and a remediation plan. You pay only for findings that matter to your business.
Low
PayoutFree
Hard-to-exploit issues, missing headers, or hardening gaps. Real findings, limited blast radius.
Medium
PayoutFree*
*Free if not relevant to your business. Otherwise up to $75.
Bounded exposure: data or actions reachable to a logged-in user, or a control that bends under effort.
High
Up to$100
Direct exposure of sensitive data or privilege, reached without chaining multiple steps or rare conditions.
Critical
Up to$200
Takeover scenarios, mass data exposure, or zero-days. The findings that change the headlines.
How "relevant to your business" works
When we report a medium finding, we'll confirm with your authorized contact whether it touches systems, data, or users that matter to your business. If it doesn't, it's free. If it does, the payout is up to $75, and it's agreed before the bounty is settled. Rates can flex for returning partners.
Set how long the engagement runs and how many findings you expect at each tier. A planning aid, not a quote.
Engagement
Findings
$375
Bounties are caps, not guarantees, and are agreed with your authorized contact before the bounty is settled. The opening fee is scoped to the size of the service and starts at $50. Need longer than three months? Ask about partnership terms.
A sample of findings from past engagements. Filter by severity to see how each tier looks in practice.
Identified unsanitized user input reflected back into the page, demonstrating the potential for malicious script execution in a victim's browser.
Bypassed frontend access restrictions using nothing more than browser developer tools, since the real enforcement never existed server-side.
Found the /auth/me endpoint returning internal authentication fields, including password-reset and email-verification tokens, enabling unauthorized access to security-sensitive account data.
Demonstrated that accounts with MFA enabled could still be accessed with valid credentials alone, without ever completing the required second factor.
Identified an endpoint that performed a privileged action for any authenticated user, with no check confirming the requester actually held the role or permission required to use it.
GET /auth/meThe live TOTP/MFA code (mfa_code) was returned as a plaintext field in the GET /auth/me response. An attacker who obtained a session token could silently read the current one-time code in real time, completely bypassing multi-factor authentication without needing access to the victim's authenticator device.
Server-side enforcement claim disproven
The claim that paid features were enforced server-side was disproven: paid functionality could be reached without an active subscription. Confirmed, and it reopens and supersedes the original paywall finding at a higher severity.
GET /auth/me: Excessive Data ExposureAccount takeover chain
The GET /auth/me endpoint returned sensitive internal fields alongside the standard user-profile response. An authenticated attacker could retrieve email_verify_token, password_reset_token, and mfa_code in a single API call, forming a complete account-takeover chain. No brute-force or injection was required: the secrets were delivered by the application itself.
Every CWE entry shares the same core structure (an ID, a name, a description, and relationships to neighboring weaknesses) and sits somewhere in the Abstraction Hierarchy, from broad Pillar down to specific Variant. CVSS scores are illustrative ranges for this class of finding; private engagement findings aren't assigned a public CVE unless a client chooses to disclose.
Nothing gets touched without a signed agreement first. Before any testing begins, we put the same document in front of every client: a written authorization that spells out exactly what we're allowed to test, what we're not, and what happens if anything goes sideways. It's the reason clients can trust us with production systems in the first place.
In plain terms
If it isn't listed in the signed scope, we don't touch it. If a deliverable or add-on isn't initialed, we don't bill for it. If you tell us to stop, we stop, immediately, no exceptions.
Every system, domain, and IP address we're allowed to test is listed by name before we begin. Anything not on that list is off-limits, full stop.
No denial-of-service, no physical intrusion, no destructive testing, no exploiting past a proof-of-concept, unless a separate written amendment says otherwise.
Anything we discover gets reported through a secure channel within 12 hours, and testing halts immediately if a client's authorized contact asks us to stop.
Anything sensitive we encounter is encrypted, shared only with the contacts you name, and destroyed once the engagement closes, unless you ask us to keep it.
Testing stays within the CFAA and applicable state law. Every deliverable and add-on is priced and initialed in writing before work starts, and any dispute goes to good-faith negotiation before anything else.
A named contact can end testing instantly for any reason. When that happens, we send a full written status report within 24 hours.
Long-term standing
Worked with us before, or want to grow past a single 3-month contract? Established partners earn better terms.
Low-severity findings are free. Medium findings are free when they don't touch your business. You only pay for what matters. We start with a conversation about what you have and what you're trying to protect.