01 / Stage
Propose
Send a short request through the project page: what you're building, what claim you want tested, and the environment it runs in. No procurement deck needed — a paragraph is enough for us to tell you whether we're the right lab.
[ engagement // workflow ]
How we work.
Five stages from first email to published evidence. The same loop that runs our own research — verify, record, investigate, attest — applied to your claim.
[ workflow // 05 stages ]
Propose → scope → verify → deliver → attest
02 / Stage
Scope
We reply within a few days with a direct read: what we can verify, what we can't, and what a meaningful result would look like — including negative results. If the question isn't answerable with evidence, we say so before any work starts.
03 / Stage
Verify
The lab runs the work: adversarial testing of the environment, falsification of the safety claim, or measurement against the agreed methodology. Findings are recorded as they occur — observed facts kept separate from inferred conclusions.
04 / Stage
Deliver
You get the evidence, not a summary of it: raw results, reproduction steps, and a written report that distinguishes what was observed from what we conclude. Where the claim doesn't hold, the deliverable is the boundary — exactly where and why it fails.
05 / Stage
Disclose & attest
Vulnerabilities go through coordinated disclosure with the maintainer — as with CVE-2025-48913 in Apache CXF. Where the evidence supports a public claim, we stand behind it; where it doesn't, nothing gets an assurance mark.
[ fit // honest_filter ]
Good fit / bad fit
[ yes ]
You want a defense, benchmark, or safety claim independently tested before you ship or publish it.
[ yes ]
You want a boundary result — to know the exact conditions under which your approach stops working.
[ yes ]
You want a negative result treated as a deliverable, not a failed project.
[ no ]
You want a rubber stamp. We attest only when the evidence supports the claim.
[ no ]
You want a pentest factory. Engagements are research-shaped: scoped questions, not hour billing against a checklist.
The method behind engagements is the lab's own pipeline — research, falsification, measurement, artifacts, findings, adoption.