Skip to content
Kytosyn

Security research

Ethical, authorized security work

We help teams find and fix security problems before someone else does. Every test we run is done with written authorization and inside an agreed scope. No exceptions.

Authorized penetration testing

Web applications, APIs, and cloud or infrastructure setups. We test what you own and have agreed to put in scope, then hand back findings you can act on: what we found, how we reproduced it, how serious it is, and how to fix it.

Bug bounty participation

We take part in public and private bug bounty programs and follow each program's rules, scope, and disclosure terms. If a target is out of scope, we leave it alone.

Vulnerability research

We study software and systems to find weaknesses before they get abused. Anything we find in a third party's product goes to the vendor first, through their own channel where one exists.

How an engagement works

  • Written authorization from the system owner before any testing starts.
  • A defined scope: which domains, IPs, apps, or accounts are in, and which are out.
  • Agreed rules of engagement, including test windows, allowed techniques, and who to call if something breaks.
  • No testing of systems we do not have permission to test. We work within Singapore's Computer Misuse Act and the laws that apply to each engagement.
  • Findings and any data we touch are handled privately and kept only as long as the engagement needs.
Talk to us about a test

Responsible disclosure policy

Found a security issue in a Kytosyn site or product? Thank you. Please tell us privately before sharing it anywhere else.

  • Email [email protected] with "Security report" in the subject, or use the contact page.
  • Include the affected URL or product, steps to reproduce, and the impact you think it has.
  • Only test against your own accounts and data. Do not access, change, or delete other people's data.
  • No denial of service, spam, social engineering, or physical attacks.
  • Give us a reasonable amount of time to fix the issue before you disclose it publicly. We will keep you updated and agree a disclosure date with you.

If you act in good faith and follow these guidelines, we will not pursue action against you for the report, and we are happy to credit you once the fix ships if you want that.