// Offensive Security Consulting
SteltSec is a team of offensive security professionals with over 15 years of experience in offensive and application security — trusted by some of the biggest names in tech to find what everyone else missed.
// About us
We are a team of offensive security professionals with years of hands-on experience in offensive and application security. Together, we have submitted ~500 valid reports on HackerOne to programs including Sony, AT&T, the U.S. Department of Defense, Capital One, Elastic, Epic Games, OpenSea, Razer, Yahoo, IBM and Dell — plus many private programs across bug bounty platforms.
Our research goes beyond bug bounties. We hold a proven zero-day vulnerability research record with the Apache Software Foundation, including accepted and published advisories with maximum-severity impact (CVSS 10.0), and a history of WordPress vulnerability research backed by assigned CVEs and validated reports.
Alongside research, we have spent years working with software companies of all sizes, delivering world-class application security services.
// Services
Real-world attack simulation against your applications, APIs and infrastructure. We think like attackers — because we are ones, on the world's largest bug bounty platforms.
Deep-dive research into your products and dependencies. Our zero-day track record includes accepted advisories for Apache Software Foundation projects — up to CVSS 10.0.
Code-assisted security assessments and architecture reviews. Years of delivering world-class application security services to software companies of every size.
Core, plugin and theme auditing backed by a proven history of WordPress vulnerability research — validated reports and assigned CVEs.
// Track record
A selection of the bug bounty programs our reports have been validated by — alongside many private programs we can't name.
Accepted and published security advisories for Apache Software Foundation projects, including maximum-severity findings (CVSS 10.0).
Proven WordPress vulnerability research history with assigned CVEs and validated reports across the ecosystem.
Years of application security work with software companies — from startups to enterprises.
Tell us about your product and your threat model. We'll get back to you with a scoped proposal — you talk directly with the people doing the work.
contact@steltsec.com