SentryStack

We build it.Then we try to break it.

Two practices under one roof. We build your product, then we attack it — so the holes get found here, on a Tuesday, instead of by someone else at 3am.

Start a projectSee the work

Terms

Critical response
Under 4 hours
Typical engagement
1–2 weeks
Pricing
Fixed, quoted up front
Re-test
Included, every time
  • Next.js and React
  • Design systems
  • Public APIs
  • Cloud infrastructure
  • CI/CD pipelines
  • Accessibility
  • Penetration testing
  • Application audits
  • Identity and access
  • Incident response
  • Cloud posture
  • Re-tests
Two practices, one firm

Building and breaking are the same skill, pointed in opposite directions.

You cannot attack a system well without knowing how it was assembled, and you cannot assemble one well without knowing how it comes apart. Splitting those two jobs across two vendors is how software ends up shipped and indefensible at once.

Build

Software that holds up under someone actively trying to get in.

  • Product and marketing sites
  • Web apps and dashboards
  • APIs and integrations
  • Performance and accessibility
See the build work

Break

Then we spend a week trying to get in ourselves.

  • Penetration testing
  • Application and cloud audits
  • Incident response and recovery
  • Monitoring and re-tests
See the security work
What we take on

Six engagements. Some of them build, the rest break.

Pick the one that matches the problem you actually have. We scope it in writing and quote a fixed fee before anything starts, then stay on it until the thing is shipped or the findings are closed.

Build

Secure Web Development

Websites built by security engineers — hardened from the first line of code, not patched after launch.

Build

Security Automation

Automated security workflows, monitoring agents, and alert bots that keep your infrastructure healthy.

Build

System Recovery

Emergency recovery, performance fixes, and hardened environment setups for Linux and Windows systems.

Break

Penetration Testing

Offensive security testing with real exploits, proof-of-concept demos, and post-test remediation.

Break

Security Audit

Human-driven vulnerability assessments with prioritized findings and hands-on remediation support.

Break

Ongoing Protection

Your outsourced security team: 24/7 monitoring, incident response, and continuous hardening.

How a project runs

Six weeks. We change sides halfway.

A full build-and-assess engagement runs about six weeks. Larger scopes take longer; the shape does not change.

Either half can be bought alone. If you already have a product, we start at the handoff. If you only want it built, we still run the attack — that part is not optional.

You get the engineer on the call at every stage, not an account manager.

  1. Day 0Build

    Scope

    We agree in writing what is being built or tested, what is off limits, who to call if the work touches production, and what the fee is. Nothing starts before you sign it.

  2. Week 1Build

    Structure

    Data model, auth, and the boundaries between them, before any interface exists. Most of what the security half finds later is decided in this week, so this is where we spend the argument.

  3. Week 2–4Build

    Ship

    Interface, content, integrations, and the deploy pipeline, in your repository from the first commit. You review working software weekly rather than mockups.

  4. HandoffBreak

    Turn on it

    We stop building and start attacking. Manual first, tooling second: a missing header alone is noise, and the request sequence that turns it into account access is a finding.

  5. Week 5Break

    Report

    Ranked by what an attacker reaches first rather than by raw CVSS, each finding carrying the exact request that reproduces it and the change that stops it.

  6. Week 6Break

    Close and re-test

    We write the fix, then run the original attack path again and confirm it fails. The re-test report, not the initial report, is what ends the engagement.

What lands on your desk

Four things you keep. One of them is proof.

The repository

Git, in your organisation

Yours from the first commit, with the deploy pipeline, environment configs and a README written for whoever inherits it. No vendor account holds anything hostage.

Findings report

PDF and Markdown

Every finding with its severity, the affected component, the impact in plain terms, and reproduction steps a developer can follow without us on the call.

Remediation guidance

Patches and pull requests

The specific change that closes each finding — config, code or architecture — written for your stack rather than copied out of a control catalogue.

Re-test report

Dated, signed

Confirmation that each closed finding now fails. This is the document you hand to a customer, an auditor or an investor.

What we do not send

  • A scanner export presented as an assessment.
  • A finding count inflated with informational noise.
  • A retainer that renews before anything has been closed.
A finding, as delivered

The exploit path, not a scanner export.

Every finding arrives in this format. The example below is generic — a common class of bug, not a client's system — but the structure and the level of detail are exactly what you receive.

Password reset accepts a previously used token

Critical
Component
Account recovery endpoint
Prerequisite
One expired reset link. No session, no credentials.
Impact
Anyone able to read one historic reset email can take that account indefinitely.

Reproduction

POST /account/reset HTTP/1.1
Content-Type: application/json

{"token":"<token from a reset email
           sent six weeks ago>",
 "password":"<new password>"}

HTTP/1.1 200 OK
{"status":"password_updated"}

Change that closes it

- if (token.isValid())
+ if (token.isValid() && !token.consumedAt)

Mark the token consumed inside the same transaction that writes the new password, so two concurrent requests cannot both succeed.

Closed and re-testedFour days, report to re-test
Before you ask

The questions we get on every first call.

How long does a typical engagement take?

A full build-and-assess project runs about six weeks. A security assessment on its own is usually one to two weeks depending on scope. We agree the dates in writing before anything starts.

Can I buy just the build, or just the security work?

Yes. If you already have a product, we start at the assessment. If you only want something built, we still run the attack against it afterwards — that part is not optional, and it is included in the fee.

Do you work with small businesses?

That is the focus. Startups and small teams get the engineering and testing depth large consultancies reserve for enterprise, without a six-figure retainer or an account manager in the middle.

What happens after you find something?

You get the finding with the exact request that reproduces it and the change that closes it. We write the patch, or sit with the engineer who does, then re-run the original attack path to prove it fails.

Who owns the code and the reports?

You do. The repository sits in your organisation from the first commit, and reports and deliverables are yours on payment. Nothing is held in a vendor account you cannot reach.

How much does it cost?

By scope, not by the hour, and we do not publish a price list — a fee that means anything comes out of a scope, and a scope comes out of a conversation. Thirty minutes on a call, then a written scope and a fixed fee before any work begins.

Do you offer ongoing monitoring?

Yes. After an initial engagement we offer continuous monitoring and periodic re-testing, so cover keeps pace with the system as it changes.

Is my data safe during testing?

We work under NDA, agree what is in and out of bounds in writing first, and delete findings and any captured data on request at the end of the engagement.

Bring us the thing you are worried about.

Thirty minutes on a call. Whether it is a product that needs building or a system you are no longer sure about, we name the biggest risk and tell you what dealing with it involves. Scope and fee in writing afterwards, not on a price list.

Book the callSee the work first

Or write to a person

support@sentrystack.io

Put Urgent in the subject line if something is happening right now and it goes straight to whoever is on call.