asynclab hello@asynclab.io

We build, advise
and secure in parallel
with your team.

Software development, architecture consulting and penetration testing by three engineers. Fixed price, a demo every week, no standing meetings.

Email us a brief Scope a pentest

An example engagement, week by week. Select a phase.
  1. Discovery
  2. Review
  3. Build
  4. Pentest
  5. Hardening
  6. Handoff

Discovery, Week 1. We read your code, infrastructure and threat model, then write the proposal. The price comes from this reading, not from a guess.

Architecture review, Weeks 2 to 3. A written assessment of what exists before we add to it: the risks that would make the build or the test harder, and what to do about each.

New billing service, Weeks 3 to 8. A demo on your staging at the end of every week (the ticks on the bar), a decision log in your repository, feature flags from day one.

Penetration test, Weeks 7 to 9. Testing starts while the build is still running, on real code, with credentials and source. Findings reach your tracker the day they are confirmed.

Hardening, Weeks 9 to 10. Fixes for what the test found, reviewed by the person who found them, then a retest of every finding.

Handoff, Week 10. Code, documentation, findings and the retest report in your accounts, and our access revoked. Nothing you depend on stays with us.

Discovery Week 1

We read your code, infrastructure and threat model, then write the proposal. The price comes from this reading, not from a guess.

Three practices, one team.

Scope a pentest, then email it

Tick what you want tested. You get the list of what we need from you and what we will do, as an email ready to send.

What should we test?
Conditions

What we will need from you

  • Written authorisation to test, naming the targets and the dates.
  • A contact we can reach if something looks wrong during testing.
  • Two test accounts per user role, where the target has accounts.

What we will do

  • Manual testing against the OWASP Testing Guide, with scanners only for coverage.
  • Every finding reproduced, rated with CVSS, and delivered with a fix.
  • A retest of every finding within 60 days, included in the price.

Email this scope

What you receive

A finding from a pentest report and a weekly note from a build, as we write them. Same parts every time, so your team can act without a call.

Password reset tokens stay valid after use

High CVSS 8.1

Affected
POST /api/v2/auth/reset
Reproduce
  1. Request a reset for an account you control and open the emailed link.
  2. Complete the reset. Then submit the same token again with a new password.
  3. It is accepted a second time, and keeps working for 24 hours.
Impact
Anyone who sees a used reset link (shared inbox, proxy log, browser history) can take over the account for a day.
Fix
Delete the token on first use, expire unused tokens after 15 minutes, and bind each token to the current password hash.
Status
Fixed on day 3. Retested, closed.
  1. Foundday 1
  2. In your trackerday 1
  3. Fixed by your teamday 3
  4. Retested, closedday 5

Week 4 of 10: billing service

Weekly note

Shipped
Invoice generation and the webhook receiver, behind a feature flag on your staging. Demo recording in the channel.
Decided
Idempotency keys kept for 72 hours, not 24: your provider retries for three days. Logged in decisions/0007.
Needs you
One answer, no meeting: should refunds over 500 EUR need a second approval? Default by Thursday: yes.

Who does the work

Three engineers. Two have competed for Spain's national cybersecurity team; between them, more than ten CVEs and open-source tools with thousands of GitHub stars. Every claim here can be checked.

Public work

Tools we maintain and research we have published. Judge the work before you pay for it.

Tools

  • nomore403Bypasses 403 and 40x restrictions. 1,900 GitHub stars.
  • debugHunterFinds hidden debug parameters and secrets in web apps.
  • geminiHunterFinds exposed Gemini API keys in web assets and Android apps.
  • Burp-MCPwnBurp Suite extension for testing Model Context Protocol servers.
  • JWTForgeDecodes, audits and forges JWTs in the browser.
  • pwny.ccPayload reference for security researchers.

Research

What you can hold us to

Questions we get first

What happens after I write to you?

We reply with questions, then a proposal with scope, price and timeline, usually within a week. If we are not the right fit, we say so and point you somewhere better.

Will you sign our NDA first?

Yes, before scoping. Yours or ours.

What do you need to start a pentest?

Targets, two test accounts per role, an emergency contact, written authorisation to test, and, for grey-box work, read access to the repository. The scoping tool above lists it per target.

Do you test in production?

Only where you want us to, never destructively. Staging that mirrors production is ideal; otherwise we agree a window and the actions that are out of bounds, in writing.

How is this different from a scanner?

Scanners find known patterns. Most serious issues are logic flaws: a token that still works, a permission check missing on one endpoint, a workflow that can be replayed. Those take a person reading your code. We use scanners for coverage and spend our time on what they cannot see.

Do you test what you built yourselves?

We will, and the report says so on the cover. For evidence an auditor must accept, a system we built should be tested by someone else; we prepare the scoping pack for them and fix what they find.

What if you find something critical mid-test?

We tell your contact the same working day, through the agreed channel, with reproduction steps and a suggested fix, before it goes into any report.

How do you charge?

A fixed price for a scoped project, or a monthly retainer for a named engineer. Invoices monthly; stop at the end of any week.

Tell us what you are working on.

hello@asynclab.io

What you are building or testing, the stack, when you need it, and a budget range if you have one. We reply within two working days.