Railo

Partners

For pentest firms and security consultants.

You find the problems. When your client then has to fix them, that is the part we do: the code-level findings become reviewed pull requests, and you and your client get the record.

How a referral works

  1. You introduce the client by email and copy us.
  2. We agree the findings in scope with the client in one short call, and in writing. A Fix Sprint is USD 1,500 for one repository and up to 25 findings; a larger report is quoted before any work starts.
  3. In one week we open one pull request per weakness against the client's repository, rescan every fix, and send an evidence pack. The client reviews and merges.
  4. You run your retest as usual, against code that has been fixed.

What you get

  • Clients who actually close their findings, which makes your retests and your reports look better.
  • An evidence pack for each client: every finding with its file, the change that closed it, who made the change, the rescan result and the merge date. See a real one.
  • The client stays yours. We do not sell penetration tests, audits or advisory work, and we do not contact your client without you.
  • A referral fee of 20% of the client's first engagement, paid when the client pays.

What we do and do not do

Railo's rule-based fixes cover the common patterns, such as injection, cross-site scripting, hard-coded secrets and insecure settings. An engineer writes the rest by hand, after reading where the code is used. Some findings are explained instead of changed, because a code change would be wrong; a committed private key needs rotating, not deleting. The evidence pack says which is which for every finding.

The fixes are rule-based, not generated by a model. The client reviews and merges every change, and we do not promise that a retest will find nothing. Nothing from the client's repository is executed on our side, and we work under the client's NDA if they have one.

Read more

We wrote down what a closed pentest finding should look like, for clients and reviewers: A pentest report is the start of the work. The audit evidence page lists what Railo records for every fix, and pentest remediation explains the service to your clients.

Talk to us

Email zarif.latif@railo.dev with a few lines about your firm and the clients you work with. A person reads it and replies within 2 business days. If you would rather try the free tool first, the GitHub Action is open to everyone.

Start a Fix Sprint