Practice 04 · Cordon
An audit that shows its work.
Cordon is a multi-phase security audit run by a fleet of agents against your source. It is built for the moment after the report lands — when someone asks “how do you know?” — and for that question to have a documentary answer.
Operating modes
Two ways in.
Not every question needs a six-phase audit, and pretending otherwise wastes your money.
A focused question, answered
You have a specific concern — an upload path, a session flow, a dependency — and want an expert read on the actual weakness, with the code path to match. Shorter turnaround, no artifact overhead.
A codebase, covered and accounted for
Six phases, a coverage ledger, schema-validated findings, independent verification and a written report. For teams that need to show diligence, not just hear an opinion.
Deliverables
What lands in your inbox.
Five artifacts, all derived from the same verified records, so the prose can never drift from the data.
- findings.json — every record, validated against a published schema. Ticket-ready.
- REPORT.md — what was in scope, what was found, what it means, what to fix first.
- FINDINGS-DETAIL.md — per-finding source trace, observed result, impact and the smallest effective fix.
- NEEDS-VALIDATION.md — hypotheses that source alone could not settle, each with the exact missing fact.
- coverage-ledger.json — what was audited, deferred and excluded. The honest boundary of the run.
Severity
What each label commits us to.
Severity is a claim with consequences. These are the anchors we calibrate against, applied only to confirmed findings.
| Label | Means |
|---|---|
| Critical | An unauthenticated actor gains code execution, full data-store access, or takeover of arbitrary accounts. |
| High | An explicit security control is fully defeated with real consequences: authentication bypass, cross-tenant read or write, stored script execution against other users. |
| Medium | A real boundary violation with limited blast radius, uncommon preconditions, or consequences confined to a narrow resource set. |
| Low | Disclosure of non-secret internals, or an effect requiring sustained effort for minimal gain. |
| Needs validation | Not a severity. A source-grounded hypothesis blocked by a fact outside the repository, carrying the exact open question. |
A defense-in-depth gap is not a vulnerability. If one control prevents the attack, the absence of another is a hardening note, not a finding — and we say so in those words.
Rules of engagement
What we will not do.
- We do not probe your production environment, or anyone else's.
- We do not execute untrusted code outside an isolated sandbox with egress blocked; without one, the finding stays needs_validation rather than being guessed at.
- We do not publish, disclose or reuse your code or findings without written authorisation.
- We do not inflate a report to justify an invoice. A clean audit is a legitimate outcome.
Scope & pricing
Priced per cycle, not per hour.
Audits are quoted after a short reconnaissance call, because a four-service API and a payments platform are not the same job.
Standing audit
From USD 500 / month
One application per cycle, with a re-run against your fixes included.
Where scope usually stops
Live penetration testing against deployed infrastructure, social engineering, physical assessment and 24/7 monitoring are separate engagements. We would rather name the boundary than quietly imply it is not there.
Ask us the hard question first.
Send the repository's shape — language, services, what it exposes — and we will tell you what a first cycle covers and what it costs.
Start a conversation →