01
Frame
Start with a precise mandate.
Your company provides the authorized assets, rules, identities, access, constraints, and business context that define the investigation.
Authorized security investigations
Bring the scope.
We find what others miss.
Your company defines the authorized assets, rules, context, and constraints. RedDepth conducts the investigation, reproduces real vulnerabilities, and returns evidence your team can act on.
- Company authorized
- Evidence preserved
- Independently reproduced
In-scope application
Customer identity boundary
12active
obligations
obligations
Surface mappedAssets, identities, and state recorded
completeVulnerability candidateCondition routed for independent reproduction
activeIndependent validationAttributable evidence preserved
securedA managed offensive-security service—not another tool your team has to operate
- You define scope
- We investigate
- We validate
- You receive evidence
The engagement
Your scope in.
Actionable findings out.
RedDepth owns the investigative work between authorization and reporting. Your team provides the business context; we map, test, correlate, reproduce, and document.
02
Investigate
Go beyond scanner coverage.
RedDepth tests relationships, roles, workflows, state, trust boundaries, and business logic while staying inside the agreed scope.
03
Validate
Receive findings that hold up.
Independent reproduction and an attributable evidence chain turn candidates into vulnerabilities your team can inspect, prioritize, and remediate.
Responsible execution
Deep work.
Inside your boundaries.
Every investigation begins with written company authorization and confirmed scope. Ambiguity stops the path, evidence supports every conclusion, and your company retains authority over disclosure.
Discuss engagement requirementsScope before action
No interaction begins until your organization confirms authorization and boundaries. Unclear ownership and out-of-scope redirects fail closed.
Context handled deliberately
Product information, test identities, access references, stability limits, and escalation contacts remain tied to the authorized engagement.
Evidence before conclusion
Observations retain provenance, and vulnerability candidates are independently reproduced before they become findings.
No automatic external disclosure
RedDepth returns report drafts to your company. Submission, publication, and external communication remain your decisions.
The deliverable
Vulnerabilities your team
can reproduce.
Each validated finding connects the condition, affected asset, identity or state, safe reproduction, impact, raw evidence references, remediation direction, and known limitations.
Coverage ledgerDisposition
Authorization boundariesCross-identity and cross-rolevalidated
Recovery workflowState and replay behaviorrevisit
Upload trust boundaryContent and storage pathsin review
Unknown surfacesExplicitly accounted fortracked
Your program, our investigation
We work from the scope
your company authorizes.
That scope may come directly from your Product Security team or from a company program hosted on an established Bug Bounty platform. In every case, written rules and company authorization govern the work.
H1
HackerOneVisit platform
↗
BCBugcrowdVisit platform
↗
INIntigritiVisit platform
↗
YWYesWeHackVisit platform
↗
Platform names and marks belong to their respective owners. References indicate ecosystem support, not endorsement or affiliation.
A managed security service
You do not operate RedDepth.
We operate it for you.
Your company supplies the authorized scope, required context, access references, constraints, and points of contact. RedDepth manages the investigation and returns validated vulnerabilities with evidence. It is a company engagement, not an individual or researcher account.
Start with scope
Tell us what you need tested.
We’ll take it from there.
Begin with a high-level description of the authorized assets, program rules, business context, and desired outcome. Sensitive scope details and access material are handled through an agreed private channel.
Discuss your scope For companies and authorized company programs only.