You send scope
Tell us the project name, repositories or deployed apps, the surfaces you want reviewed, your timeline, and any confidentiality needs. Email contact@forgew3s.com to start.
METHODOLOGY
A findings standard that doesn't bend.
Forge adapts its review path to each protocol, but not its evidentiary standard. A candidate must be scoped, reproducible, technically supported, and tied to demonstrable impact before it's reportable.
YOUR SIDE
How a review works, from your side.
From your first email to a retest of your fixes — with checkpoints throughout.
We confirm fit and quote
We confirm the authorized boundaries, flag what's in and out of scope, and return a clear engagement shape: review focus, expected depth, timeline, and cost. No work begins until you approve.
Review with updates
During the review you get progress checkpoints, not a black box. We surface anything urgent — an actively exploitable issue — immediately through the agreed channel.
Validated findings delivered
You receive a scoped report: each finding with reproduction, evidence, impact, severity rationale, and fix guidance — not a raw scanner dump.
Retest of fixes
After your team remediates, we retest the fixes against the original reproduction to confirm the issue is closed — not just patched around.
OUR GATES
The review pipeline behind the scenes.
Every candidate must pass two gates before it becomes a finding: technical validity (is it real?) and evidence sufficiency (can it be reproduced?). Suspicion alone never becomes a finding.
Scope Validation
Before any testing: we confirm authorized boundaries, target assets, repository state, deployment context, exclusions, and what success looks like for your review. Nothing gets tested until the scope is agreed in writing.
Operational Intake
We stand up a controlled review workspace, map the system and its dependencies, and separate public project material from sensitive client evidence — so your code and findings never travel through the wrong channel.
Dual-Gate Evaluation
Every candidate is investigated by manual review, focused test construction, runtime analysis, and supporting tooling — then must pass two gates before it becomes a finding: technical validity (is it real?) and evidence sufficiency (can it be reproduced?). Suspicion alone never becomes a finding.
Mitigation and Delivery
You receive validated findings with reproduction steps, supporting evidence, impact analysis, severity rationale, and practical remediation guidance — delivered through the agreed channel, ready for your engineers to act on.
Benchmark
Reportability requires more than suspicion.
Scanner output, assumptions, and severity guesses may start an investigation, but they do not become findings until the evidence supports them.
- Scope before testing
- Evidence before assertion
- Reproduction before severity
- Proof before reporting
- Responsible disclosure before publicity