Whitenbaker
Triage · By Retainer
Nothing reaches your engineers until it has fired.
We take a small number of clients. Every report that arrives is test fired in a controlled lab before you hear about it.
What you receive
Confirmed
It ran. Here is the replay.
Killed
It did not. Here is what we tried.
Undetermined
We could not settle it, and we will not pretend otherwise.
01 · The difference
The math does not clear the gap.
You can calculate every variable on the jump. Speed, angle, incline, the exact velocity you need at the lip of the ramp to land clean on the other side. Get all of it right and you still have not jumped anything.
That is the difference between describing a vulnerability and firing one.
Never sent to you
- Could allow
- May permit
- An attacker might
- Potentially exploitable
- Could be leveraged
- May be possible
- In theory
- Appears vulnerable
- Should be considered a risk
“Nine ways of saying nobody tried it.”
Method
Four gates, then the lab.
A finding clears every one of them or it does not reach you. Most die at the first two, and they die cheaply, which is the point.
Clears all four, we build it and fire it. Then you get it, with the replay. Everything else you get a written kill, so you can see what died and why.
I · Scope
Authorised, in scope, and ours to test. Anything outside it dies here before a single hour is spent.
II · Prior art
Already public, already fixed, already sitting in your queue from somebody else. Checked first, not last.
III · Reachability
The call chain that reaches the code, the input that triggers it, the state change that results. Reached, not reachable.
IV · Boundary
It crosses a real security boundary. Attacker and victim are different people holding different rights.
Then the lab · Kill loop
Adversarial passes built to destroy the finding. What survives people actively trying to break it is what we send you.
04 · Correspondence
We answer researchers in our name, never yours.
Correspondence about an unfixed vulnerability is discoverable. A sentence written under pressure by somebody closing a ticket becomes your statement if it went out under your name, and it can be read back to you later.
We correspond as Whitenbaker, retained to assess the report. We commit you to nothing and represent nothing about your product.
Either way, it is a switch you set, any time.
Terms
Shaped to you.
Per report, by volume, or a flat monthly retainer. Some programs want us on everything, some only on what their own team could not settle. We work out which one fits after we have seen your inbound, not before.
Send us your program and your last thirty reports. We read them, then we tell you what we would charge and whether you need us at all. Sometimes the answer is that you do not.
One
You send your program and your last thirty reports.
Two
We read every one of them ourselves.
Three
We tell you the price, or that you do not need us.
03 · Researchers
Submit your finding. We fire it before you write a word.
If your bug is real you get back a battle tested report that clears triage in minutes, not days. If it is not real we tell you before you waste thirty minutes writing something that gets closed Informative.
An N/A hurts your reputation. A kill saves it.
Your name stays on the work, watermarked and credited. We do not repackage anyone’s finding as ours, and we never claim to decide your bounty.
Engage
Independent vulnerability verification.
Send your program and your last thirty reports. We read them before we quote you.