Keys in the open
Passwords, API keys and tokens sitting in code, in the browser, or in files anyone can download.
Engineering reviews · Hardening · Monitoring
We build
the labyrinth.
Most apps and sites built fast leave doors open: keys in the open, no limits, one customer able to see another's data. We find them, close them, and watch the rest. Plain-language findings, fixed prices, and nothing touched without your written permission.
Anyone determined enough can eventually get into anything. Nobody honest will tell you otherwise.
We close the doors that are standing open, which is where nearly every real incident starts. And we watch the rest.
What we look for
The doors left open.
The same handful of gaps show up again and again in apps built quickly, by people or by AI. They're rarely exotic. They're usually just missed.
No limits
Sign-ups, logins and paid features anyone can hammer a thousand times a minute, at your expense.
One customer, another's data
Accounts that can reach records that aren't theirs by changing a number in the address.
Unsafe input
Forms and searches that pass what people type straight into the database or the page.
Money that runs twice
Payments, payouts and credits that can be triggered twice by a double click or a retry.
Uploads that misbehave
Files people upload that your site will happily serve back as a working page.
Old parts
Libraries and plugins with known, published problems that were never updated.
Missing basics
The settings every browser checks for, from HTTPS everywhere to cookie and framing rules.
The work
Find it. Close it. Watch it.
The Review
An engineering review
A read-only look through your code and setup, in scope you sign off on. You get every finding ranked by how much it matters, in plain words, with the fix for each.
The Labyrinth
Hardening
We close what the review found: limits, safe file handling, keys moved out of reach, payments that can't run twice, each customer walled off from the next.
Talos Early access
Watching
A quiet watcher on the sites and code you connect. It spots errors, downtime, bot traffic and leaked keys early, and tells you what to do about each. Try the free self-check.
The Gatekeeper
Ask us before you buy
Being pitched AI or software you don't fully understand? Send it to us. We look at the product and the pitch, and tell you plainly if it's worth it. We take nothing from vendors, so the answer stays honest.
How it works
Five steps, in this order.
Permission
You list what's in scope and prove it's yours. We touch nothing else, ever.
The review
Read-only, inside the window you set. Nothing changes on your live system.
The findings
Ranked by how easily each could be used and how much harm it could do, in words you don't need a developer to read.
The fixes
Your team fixes them with our notes, or we do it for a fixed price. Then we check them again.
The watch
Talos keeps an eye on what you connect and tells you early when something changes.
Why the name
Daedalus built the labyrinth.
He was the first master builder of the Greek myths: the labyrinth, the wings, and a bronze guardian, Talos, who walked the walls of Crete every day.
That's the work. Build it so the way in is long, confusing and watched. Keep a thread back to the cause when something goes wrong. And never fly too close to the sun.
Start here
Tell us what you've got.
A fixed price, quoted after a short call. Nothing is looked at until you've signed off on the scope.
Received.
We'll be in touch within one working day.
Questions
Straight answers
Is this a guarantee that we can't be hacked?
No, and be wary of anyone who offers one. A review is a careful look at your system as it stands, and it closes the gaps that cause most real incidents. Nothing makes a system untouchable. What we do makes it far harder to get into, quicker to notice when someone tries, and faster to fix.
Will you test anything without permission?
Never. Every engagement starts with a signed scope, and you prove you own everything in it. We don't look at anything that isn't on that list, including your vendors' systems.
Do you need access to our live system?
Usually read-only access to your code and settings is enough. Anything more active happens on a test copy, inside the window you set. We never change your live system without your written approval.
We built it with an AI tool and don't really know the code. Is that a problem?
That's exactly who this is for. The findings are written for the person who runs the business, not just for developers, and we can make the fixes for you.
What happens to what you find?
It's yours and stays confidential. We never publish findings or name you without your written permission, and we delete your materials when the work ends.
What does it cost?
One fixed price, set after a short call once we know the size of what you've built. No hourly meter.