We are the people reading your perimeter while you read the audit report.
Outer Index has no office, no headcount and no logo on a conference lanyard. What it has is a list of companies that left the door open, and the patience to walk past every one of them.
The mistakes are always the same. A key that should have stayed on the server. A staging box nobody remembered. An admin panel that trusted whoever showed up. Different logos, same story.
We are not selling anything. There is no consulting offer at the end of this page. The only thing we want from you is to read your own JavaScript before we do.
01/What we are
- Unaffiliated
- Nobody pays us, nobody tells us where to look, and nobody gets a heads-up because they know someone. Targets are picked by how bad the mistake is.
- Patient
- We do not need you to slip today. Your next deploy, your next subdomain, your next intern with production access. We will be around.
- Outside
- We never need to be let in. Everything on the board was already on the internet. You just did not know it yet.
- Exact
- Every claim comes with receipts. Arguing with us means arguing with your own HTTP responses.
- Unimpressed
- Your ISO certificate, your SOC 2 report, your bug bounty badge. None of it was checking your JavaScript.
- On the record
- Every op is written down, dated and archived. The internet forgets. We do not.
02/Got a message from us?
Then you already know what we found.
Our messages only come from the addresses on the Signal page. Anything else using our name is not us. Read the manifesto, then answer. The board updates either way.