Frequently asked questions

It depends on the service and the scope we agree. A web application or API penetration test focuses on manual testing of areas such as authentication, authorization, session handling, input handling, and business logic. A vulnerability assessment identifies and validates known weaknesses across agreed assets. A code review examines source code for security flaws. The exact test areas are listed in the agreed scope before work starts.

We start with a discussion about what you want assessed, why, and any constraints. We then propose a written scope covering targets, environments, test types, timing, and exclusions. Testing only begins once the scope is agreed and written authorization is in place.

A written report that summarises the results for decision-makers and documents each finding for your technical team — with a risk rating, supporting evidence, reproduction steps, and remediation guidance.

Assessment information — including findings, credentials provided for testing, and reports — is treated as confidential and shared only with the contacts you nominate. Please don't send credentials or vulnerability details through the website enquiry form; we arrange a secure channel once an engagement is agreed.

Yes. Our services are designed for remote delivery to clients internationally. Testing is performed against internet-reachable or remotely accessible environments that you authorise, and communication happens over agreed online channels.

We go through the findings with your team and answer questions about remediation. If retesting is part of the engagement, we verify the fixes once you've applied them and update the report.

Use the assessment request form to tell us about your application, API, or codebase and what you need. We'll reply to arrange an initial discussion and agree an appropriate scope.

Cyber Secret Society (CSS) is a founder-led cybersecurity company focused on application security: web application and API penetration testing, vulnerability assessment, secure code review, and practical security training. We also run a learning community with free articles, reference material, and CTF challenges.

Web application penetration testing, API security testing, vulnerability assessment, secure development and code review, and security training and CTF exercises for teams. Each service has its own page describing what it covers and what you receive.

Yes. We only test systems with written authorization from someone entitled to give it, within a defined scope and rules of engagement. We never test systems speculatively or without permission.

Please email admin@cybersecretsociety.com with a description of the issue, without including sensitive data. Don't access data beyond what's needed to demonstrate the issue, and give us a reasonable chance to respond before any public disclosure.

It's the learning side of Cyber Secret Society: practical articles, a security glossary, an investigation guide, threat-actor profiles, learning-path outlines, and CTF challenge categories. Follow our official channels for updates.

No. Community resources are freely available on this site. Team training is a separate engagement planned around an organisation's learning objectives — see Security Training & CTFs for Teams.

Only on systems you own or are explicitly authorized to test. Our learning content and CTF challenges are intended for safe, isolated lab environments. Testing systems without permission is illegal.