Skip to content
NamadaSecurity operations

What we actually do, and what you get

Four engagements, written down the way you would brief them: what is in scope, what leaves our hands, how long it runs, and what it costs. Every one of them is scoped and priced in writing before work starts.

Scope an engagement

The four services

Each of these is a different kind of work with a different deliverable. The detail below is what tells them apart, and which one is yours.

EVM, SVM and Vyper

Smart Contract Audits

Manual review paired with symbolic execution and fuzzing across the bug classes that actually drain contracts: accounting desync, access control, oracle manipulation and reentrancy.

  • Line-level report with severity and exploitability
  • Runnable Foundry or Anchor proof-of-concept per finding
  • Remediation review and re-test after each fix
  • Solidity
  • Vyper
  • Rust / Anchor
  • Foundry
  • Halmos
Scope this service
OWASP Top 10 and beyond

Web App & API Penetration Testing

Authenticated and unauthenticated testing of your application, API surface and identity flows, with business-logic abuse cases written against your actual workflows rather than a checklist.

  • Prioritised findings mapped to CVSS v3.1 and CWE
  • Reproduction steps a developer can follow unaided
  • Retest window with a closure letter for compliance
  • OWASP Top 10
  • OAuth 2.0 / OIDC
  • GraphQL
  • REST
  • WordPress
Scope this service
Cut duplicate noise by 80%

Automated Bug Bounty & VDP Triage

Every inbound report is parsed, scored and matched against your submission history before a human opens it, so your engineers spend their time on novel issues rather than re-reading variants.

  • Automatic CVSS v3.1 vector derivation
  • Duplicate and variant detection against prior reports
  • Routing to the owning team with an SLA clock attached
  • HackerOne
  • Bugcrowd
  • Intigriti
  • Immunefi
  • Jira
Scope this service
Next.js and cloud architecture

Secure Full-Stack Web Development

We build the product and the controls together: typed end-to-end, least-privilege by default, with the threat model written before the first migration and enforced in CI afterwards.

  • Next.js App Router build with typed server boundaries
  • Infrastructure as code with policy checks in CI
  • Threat model, runbooks and on-call handover
  • Next.js
  • TypeScript
  • PostgreSQL
  • Terraform
  • AWS / Vercel
Scope this service

The scanners on this site are demonstrations: the contract rule pack (engine namada-audit 2.4.1) is real, the web scanner is a labelled simulation that sends no traffic to the target you type, and neither runs under a signed scope. A production assessment runs against an authorised target list, under the rules of engagement below.

Each engagement, in full

Scope, deliverable, duration and price, one service at a time.

Smart Contract Audits

EVM, SVM and Vyper

For a protocol before a mainnet launch or a token generation event, or for a material upgrade to something already deployed and holding value.

In scope

  • Solidity, Vyper and Rust/Anchor source, pinned to a commit — a single repository or a named range.
  • The full 30-class rule pack: 15 Solidity classes, 8 Vyper and 7 Rust/Anchor, covering access control, accounting desync, oracle manipulation, reentrancy and incomplete paths.
  • Deployment and upgrade wiring: proxy patterns, initialisation, ownership and role configuration.
  • Off-chain code only where it changes on-chain behaviour — keeper bots, price feeds and transaction builders.
  • Every candidate the rule pack raises passes a refutation pass (Claude Mythos 5.1, or Claude Fable 5.1 where the deployment has no Cyber Verification Program admission) that has to argue it is unreachable. Only survivors reach the report, and only survivors get a minimal patch drafted (Claude Opus 5.5) with a regression test.

What you receive

  • A line-level report: severity, the code path it lives on, and an argument for exploitability rather than a pattern match.
  • A runnable Foundry proof of concept for the three classes that ship one — reentrancy, access control and oracle manipulation — and reproduction steps for every other finding.
  • A remediation review: each fix is retested against the same path, and the report records what closed and what did not.
  • A signed report for investors and exchanges, and a finding set you can import into your own tracker.
Runs forFive to ten business daysKickoff to delivered report for an engagement up to 5,000 lines. Remediation questions are what move it, not the review.
PricedFixed fee per engagement$12,000 for up to 5,000 in-scope lines, quoted from the line count and complexity. The retest window is included.

Web App & API Penetration Testing

OWASP Top 10 and beyond

For a launch, an enterprise security review, or the moment a customer sends a procurement questionnaire you have to answer with evidence rather than a policy.

In scope

  • Authenticated and unauthenticated testing of the application, its API surface and its identity flows.
  • Business-logic abuse written against your real workflows: privilege boundaries, payment and refund paths, multi-tenant isolation.
  • Session and authorisation handling — OAuth 2.0 and OIDC flows, JWT validation, password reset and invitation paths.
  • Baseline posture first: the same 18 checks the public scanner runs — TLS, security headers, cookie flags, CORS, exposed surfaces — confirmed against the real target before manual work starts.

What you receive

  • A prioritised findings report mapped to CVSS v3.1 and CWE, ordered by what an attacker reaches first rather than by scanner convenience.
  • Reproduction steps a developer can follow unaided — request, response, and the state required to reach it.
  • A retest window, and a closure letter for the compliance file once the fixes are verified.
Runs forOne to three weeksScoped to the number of targets and authenticated roles. A single application with one role is usually at the short end.
PricedFixed fee per target and windowQuoted from the scope. The retest is part of the engagement, not a second one billed when you come back.

Automated Bug Bounty & VDP Triage

Cut duplicate noise by 80%

For a team running a public or private programme where the triage queue has become the bottleneck between a valid report and the person who can fix it.

In scope

  • Every inbound report on the programme, from first parse to routing. The automation sorts and scores; it does not close a report.
  • Duplicate and variant detection against your submission history, so a re-report of a known issue is matched rather than re-read.
  • CVSS v3.1 base vector derivation by the deterministic engine, then a judgement pass (Claude Sonnet 5.5) that weighs the inputs the reproduction actually supports.
  • Routing to the owning team with an SLA clock attached, and a status the reporter can see without emailing anyone.

What you receive

  • A triaged queue: each report carrying a derived CVSS v3.1 vector, a duplicate match where one exists, and an owner.
  • Deduplicated summaries, so an engineer reads the novel issue rather than its five variants.
  • A monthly record of intake, duplicates, valid findings and time-to-first-response for the programme owner.
Runs forLive within 48 hoursFrom connecting the platform account. The first week is normally spent calibrating duplicate matching against your own submission history.
PricedMonthly retainer per programmeScaled to inbound volume. Included in the continuous engagement for teams already on it.

Secure Full-Stack Web Development

Next.js and cloud architecture

For a team building the product now, who would rather have the controls designed in than assessed afterwards and rewritten.

In scope

  • A Next.js App Router build with typed server boundaries — no untyped data crossing between client and server.
  • Authentication, authorisation and tenancy modelled before the first migration, not patched in after the first incident.
  • Infrastructure as code with least-privilege policies, and those policies checked in CI on every change.
  • A threat model written at the start, kept current, and cited in review.

What you receive

  • The working application, the infrastructure that runs it, and the pipeline that deploys it.
  • A written threat model, runbooks for the failure modes it names, and an on-call handover.
  • The same rule pack and reasoning pass an audit runs, wired into your CI as a gate rather than a report.
Runs forSprints over weeks to monthsScoped to the build. The first deployable slice is normally in review inside two weeks, with the threat model written before it.
PricedDay rate or monthly retainerScoped ahead of each sprint, so the cost of a change is agreed before it is built rather than after.

How an engagement is bounded

What you commit to, what the document obliges us to, and what we can reach once you have committed. These apply to every service above without exception.

How scoping works

Scoping is a short written exchange rather than a discovery funnel. You send the targets and what worries you; we send back a document that names exactly what we will touch, what we will not, and what it costs. Nothing is tested until that document is signed.

  • You send: the target list, the repository or commit range, test credentials, and any window we must avoid.
  • We send back: a fixed fee, a named researcher, a date range, and the exclusions we propose.
  • The scope is fixed before work starts. Changing it is a written amendment, not a verbal one.
  • No target is touched until the authorising signature is on the document.

What the signed scope and rules of engagement contain

The rules-of-engagement document is the part that protects both sides. It is the difference between an authorisation and an assumption, and it is the document you would hand a regulator or a customer who asked who was allowed to do this.

  • The authorising party, by name, and confirmation that they are entitled to grant access to every target listed.
  • In-scope targets identified precisely — hosts, repositories, accounts — with the out-of-scope list beside them.
  • The testing window in a named timezone, an emergency contact, and a stop condition that halts work immediately.
  • Prohibited techniques: denial of service, social engineering, physical intrusion, and anything touching third-party infrastructure.
  • Data handling: what is collected as evidence, where it is stored, and when it is destroyed.
  • Disclosure terms: embargo length, who may be told, and what is published once the fix is live.

The read-only repository access model

Source access is the smallest grant that supports the work, and it is the first thing revoked at the close. We do not request production write access, and we will not accept it if it is offered.

  • A read-only deploy key or a short-lived token, scoped to a single repository.
  • No push, no CI secrets, no cloud credentials, and no ability to change anything you depend on.
  • Source is held for the duration of the review and deleted 30 days after report delivery unless you ask us to retain it.
  • Access is revoked when the report is handed over, and the revocation is confirmed to you in writing.

Send us the target list

Scoping takes one exchange, not a call series. Tell us what you need looked at and we will send back the scope and the price.

Scope an engagementWhere we work