AI era service

Fix sprints

We don’t just report it. We help fix it.

We fix what we find. Researchers write the patches, open pull requests, and retest until it holds.

  • Pull requests
  • Secure defaults
  • Regression tests
Book a scoping callWhat we look at

Scope and deliverables

What we look at

  • Patches written in your framework and conventions
  • Policies and middleware so the class of bug cannot return
  • Tests that fail if an issue comes back
  • A walkthrough with your engineers

What you get

Merged fixes and a clean retest letter.

Typical length

Days, not weeks

Methods aligned with

OWASP ASVS, CVSS 3.1

Why it matters

Most AI-built apps don’t have a security engineer on the team. A report full of findings only helps if someone can turn it into working fixes.

In a fix sprint, the researchers who found the issues write the patches in your framework and conventions, open pull requests, and retest until each fix holds.

What a fix sprint delivers

  • 01

    Patches in your codebase

    Delivered as pull requests, written in your framework’s idioms.

  • 02

    Secure defaults so it stays fixed

    Policies, middleware and tests that fail if the issue comes back.

  • 03

    Prompts for your AI assistant

    Fix instructions your team can hand to its AI coding assistant, reviewed by us after.

How we test it

Hackbots for breadth. Hackers for depth. Every lead is proven or discarded by a researcher before it reaches your report.

Our hackbots

  • Re-run every original attack against the patched build
  • Keep the regression checks running on each release

Our researchers

  • Write each patch and review it before it reaches you
  • Add policies and middleware so the class of bug cannot return
  • Walk your engineers through every change

How an engagement runs

Five steps from the first call to the retest. You work directly with the researchers testing your systems at every one of them.

  1. Scope

    1 to 3 days

    We agree on assets, test accounts and rules of engagement, then send a fixed price.

  2. Recon

    First days of testing

    Hackbots map every host, route and role. A researcher builds the threat model.

  3. Exploit

    Most of the window

    Hackbots run the matrix at scale while researchers test by hand and take each lead to the end.

  4. Report and fix

    Within 5 working days

    Verified issues only, each with a CVSS 3.1 vector, replayable proof and a patch.

  5. Retest

    Free, within 90 days

    We confirm each fix and issue an updated report and attestation letter.

All 9 services

Tell us what you run. We’ll send a fixed quote.

No obligation and no sales sequence. A senior researcher reads every request and replies within one working day.

Book a scoping call[email protected]