Request a security test

Tell us what you want tested and who you are. We read every request and reply from a real address, usually within two working days.

Before you start

What you will need

Nothing you have to go and find. If you know your own systems, you can finish this in about four minutes.

The exact addresses you want tested Hostnames, full URLs, IP ranges or an API base URL. One per line.
Anything next to them that must not be touched Shared services, a payment provider, a partner's system on the same domain.
Who hosts it AWS, Azure, Google Cloud, your own racks, or a platform like Shopify. "Not sure" is a valid answer.
Authority to ask You will confirm your organisation controls the targets and that you can request testing on its behalf.

Sending this does not book a test, and it does not authorise one. We verify that you control every target, we agree the scope in writing, and both sides sign rules of engagement. Nothing is touched before that. We approve requests at our discretion and we say no when the scope is not ours to test.

This form does not transmit anything on its own. When you finish, it opens a pre-written email in your own mail client, addressed to us, which you send yourself. Nothing is stored here and nothing is sent until you press send.

Step 1 of 4

You and your organisation

This is how we reply, and it is the first check that the request comes from inside the organisation that owns the target.

Full name The person we reply to, and the name that goes on the engagement record.

Your role or job title It tells us whether to route this to a scoping call or to a written proposal for someone above you.

Work email Use an address at your organisation's own domain. A free mailbox is the single most common reason we cannot verify a request.

Organisation, as registered The full legal name from your incorporation or registration certificate, including the suffix. Not your trading name, not your website. For example Northwind Systems Private Limited, not Northwind or northwind.io. This is the name that goes on the contract, so it has to match your paperwork exactly.

Country the organisation is registered in Where the company is incorporated, which is not always where you or the servers are. It decides which contract we send, whether a data processing agreement rides with it, and which testing law applies.

Phone number We confirm scope by voice before anything is tested, and if a test ever affects a live system we need to reach you in minutes rather than by email. Pick the country code, then the number without it.

Step 2 of 4

What you want tested

Be exact. Everything you do not list here is out of scope by default, and we will not touch it.

What we test today One thing, done properly. The rest is being built and we will not sell you a date for it.

Web applicationWhat this request is for.

APIIn build

Coming soon

Cloud environmentIn build

Coming soon

Server or networkIn build

Coming soon

Mobile appIn build

Coming soon

If what you need is on the coming soon list, send the request anyway and say so in the notes. We will tell you honestly where it stands rather than take the work and improvise.

In scope: the exact targets One per line. Hostnames like app.example.com, full URLs like example.com/portal, or IP addresses and CIDR ranges if the application is reached that way.

If you listed a wildcard such as *.example.com

I did not list one Every subdomain is in scopeExcept anything you exclude below. Only the exact hosts I typedTreat the wildcard as shorthand, not permission.

Out of scope: do not touch (optional) Anything adjacent that is fragile, shared, or not yours to authorise. A short reason next to each helps, for example payments.example.com: third party processor.

Environment A production target changes how we test, not whether we will.

Production, live users Staging or UAT Development A mix of these

Rough size An estimate is fine. It sets the length of the pilot, nothing else.

Step 4 of 4

Authority

This is the part that decides whether we can act at all. Testing something you do not control is a criminal matter for both of us, so we ask plainly and we check afterwards.

Your relationship to the target

My organisation owns it We operate it under contract for the ownerWe will need the owner's written permission too. I am placing this for a clientMSP, vCISO or agency. We work under your brand if you want. Something else, I will explain below

Anything else we should know (optional) Known problems, a previous report, a system you already suspect, a deadline. Please do not put passwords or access keys in here.

Confirm before you send Three separate statements. We need all three, and we keep your email as the record of them. My organisation owns or controls every target I listed, and I am authorised to request testing on its behalf. I understand nothing will be tested until Tips to Secure has verified control of the targets and both sides have signed written rules of engagement. Where someone else runs the infrastructure, I understand their permission may also be needed, and I will help get it.

Review

Check your answers

This is exactly what goes in the email. Nothing has been sent yet.

Last step

Send it from your own mailbox

We do not collect this behind your back. Open it in your mail client, read it, send it. It arrives from your work address, which is the first thing we check.

Open in Gmail Open in my mail app

Which button. Gmail opens in a browser tab and works anywhere you are signed in. The mail app button hands over to whatever your device has set as its default mail program, which is Mail or Gmail on a phone and Outlook or similar on a computer. If your computer has none set up that button will do nothing, which is not your fault. Copy and paste always works.

If none of them work, email the text above to .

Request ready

Thank you

What happens next

We will contact you A person reads it and replies from a real address, usually within two working days. You will hear from us either way, including if the answer is no.
One verification step If we take it on, we send you a short random string to put in a DNS TXT record on your domain, or a file to place at a path we name. That proves you control the target.
Scope and rules of engagement Signed by both sides. Only then does anything get tested. Nothing before that.

Keep your reference number. Quote it if you write to us separately and we will find the request.

Request a security test

What you will need

You and your organisation

Check these before continuing

What you want tested

Check these before continuing

Hosting, data and timing

Check these before continuing

Authority

Check these before continuing

Check your answers

Send it from your own mailbox

Thank you

What happens next