Manifesto

Nobody you would recognise. We do not do conferences, we do not do LinkedIn, and we are not looking for a job. We read the internet the way an attacker reads it, and we write down what we find.

We have no sponsors, no clients and no friends in the industry. That is what lets us say the things the industry will not.

You told your customers their data was safe. You put it in the privacy policy. You put it on the homepage, next to the padlock icon.

• Your API keys are in your JavaScript.
• Your staging server has your production database on it.
• Your admin panel does not have a login screen.
• Your bucket answers to anyone who asks nicely.
• Your security.txt does not exist.

None of this needed a zero-day. It needed someone to look. You did not. We did.

You trusted them with your name, your documents, your money. They trusted a config file. You deserve to know which companies treat your data like an afterthought. That is what the board is for.

• We do not forget a subdomain.
• We do not forgive a hard-coded key.
• We do not stop at the first company.
• If you are reading this from inside a security team, check your bundle. Now.