Hire me

Black Pearl finds the open doors on its own. When you want someone to walk through the whole house, that's me.

What I can do for you

Website audit. A full penetration test of your website or web app, approached from the outside the way an attacker would. You get every finding ranked by risk, each with its fix.
Continuous monitoring. Black Pearl keeps watch over your website on a regular schedule and alerts you as soon as something new appears: an exposed file, an outdated component, a page left open, a leaked key.
Help with a fix. A flaw was reported to you, by me or anyone else? I work with your team until it is closed and checked.
OSINT exposure audit. What the internet already knows about your organisation: leaked credentials, secrets in public code, forgotten subdomains, the attack surface you didn't know you had.

You write to me with your website or app, what you need and when.
We agree on the scope. A written agreement sets exactly what I may test, and how. Nothing outside it is touched.
I do the work and send you a report in plain words, readable by your developers and your management alike.
I check your fixes, so you know the doors are really closed.

Every finding explained in plain words, ranked by risk, with its fix. An excerpt:

Sample report fictional website

Critical
Database backup downloadable by anyone
A full copy of the customer database sits in a public folder, one URL away from any visitor.

Fix: remove it from the web root, block the folder, change every password it holds.
High
Payment API secret in the public JavaScript
The live secret key of the payment provider ships in the site's main script.

Fix: revoke the key, issue a new one, keep it on the server only.
Medium
Pages can be framed by any other site
No header forbids embedding, which leaves the door open to clickjacking.

Fix: send Content-Security-Policy: frame-ancestors 'self'.

Every mission is quoted after a first exchange, because it depends on the size of what we test.

Write to beacon0x@proton.me. Tell me about your website or app, what you need and your timing.

For anything sensitive, encrypt your message with my PGP key.