Skip to content
Cognivators
All engagementsTaking clients
01 / Snapshot

One honest read on one target, before you commit to a full review.

A fast first look at one application, API, or MCP server. Two pages, plain language, and a straight answer on whether a deeper review is worth doing.

Book the SnapshotAsk a question first

Fixed scope · 1 to 2 business days· scoped in writing first

What it costs to leave it

  1. Guessing wrong either way

    A review you did not need, or a bug that stays in production because nobody looked.

  2. Noise instead of a judgment

    A free scan gives you two hundred lines and no opinion.

  3. Signing blind

    A Statement of Work with someone whose reporting you have never read is a bet.

How it gets closed

Exactly what
gets reviewed.

One target, one pass, one short document. Then a fork.

One targetapp, API, or MCP serverScan, then hands1 to 2 business daysTwo-page summaryplain language, one answerNothing seriousyou stop hereWorth a deeper lookfee credits toward itCREDIT HOLDS 30 DAYS
  1. 01

    One target

    An application, an API, or an MCP server. You pick.

  2. 02

    Scan, then hands

    The scan narrows the surface. A manual pass judges what it cannot.

  3. 03

    Two pages, plain language

    What stood out, why it matters, where a full review would go.

Timeline

A fixed calendar.
No open-ended scope.

Standard turnaround · 1 to 2 business days

  1. Day 0

    Scope confirmed

    One target, in writing.

  2. Day 1

    The pass

    Scan, then a manual look.

  3. Day 1 to 2

    Summary delivered

    Two pages and a straight answer.

Public record

Same class of bug,
found in public.

Every row links to the vendor's own repository or advisory and names the author.

  1. Google

    CVE-2026-14540

    Server-side request forgery in the generic HTTP source and tool components of MCP Toolbox.

    Reported. Fixed by Google, credited by name.

    Fixed Jun 2026

  2. GitHub

    github-mcp-server #3056

    A redirect-following transport re-attached the GitHub token on every hop. Hardened so it's only attached to GitHub's own configured hosts.

    Patch authored here, merged upstream.

    Merged Aug 2026

  3. Weaviate

    PR #12961 · HackerOne

    Google module accepted an arbitrary apiEndpoint, a credential-exposure path.

    Confirmed. Fixed by Weaviate.

    Merged Sep 2026

  4. JPMorgan Chase

    jpmorgan-payments/ai #19

    One tool skipped the domain allowlist its sibling tool already enforced.

    Validated and fixed through JPMC Responsible Disclosure.

    Merged Sep 2026

  5. 1Password-MCP (community)

    GHSA-q3gg-rgxh-gh64

    op_run leaked the OP_SERVICE_ACCOUNT_TOKEN master credential to subprocesses and model context.

    Advisory published, credited by name.

    Source

What you get

Fixed scope.
Confirmed in writing.

Security Snapshot

  • A written summary: what was looked at, what stood out, whether to go deeper
  • Honest severity. If nothing serious turns up, it says so
  • The fee credits in full toward any engagement booked within 30 days
Target
One application, API, or MCP server
Turnaround
1 to 2 business days
Deliverable
One to two page written summary
Retest
None. Fee credits toward a full engagement
Access
A URL or a repo, and confirmation you control it

Priced after a short look at the system, confirmed in writing before anything is touched. Scope that grows is re-quoted first, never billed after.

Book the Snapshot

Before you email

Anything else: ask it first. No scope is confirmed until it is answered.

01 / Snapshot

Ready to find out what is actually there?

Book the SnapshotCompare all three

Fixed scope · 1 to 2 business days

Replies come from the person doing the work, within one business day.